AIKIDO-2026-152747
drupal/freelinking is vulnerable to Information Disclosure
45
Medium Risk
This Affects:
drupal/freelinkingTL;DR
The Freelinking module crawls external URLs and uses their page titles as link text. It does not block privately accessible targets, including localhost and private or reserved addresses, and crawling is enabled by default. An attacker who can use a text format with the Freelinking plugin enabled can reveal page titles of URLs that the web server can reach. The fix turns crawling off by default and skip those private targets.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and a text format with the Freelinking plugin is enabled (external URL scraping was on by default).
Background info
drupal/freelinking is vulnerable to Information Disclosure in versions 0.0.1 - 4.0.2 and 5.0.0-alpha1 - 5.0.0-alpha2.
How to fix this
Upgrade the drupal/freelinking library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.