I’ve definitely seen that if it’s a url, my preview will tell me the title of the webpage on the other end. That might only scan the basics, but I don’t think it’s implausible that preview code could have vulnerabilities.