CVE-2026-44439
HighSummary
Prior to version 1.39.6, PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could exploit redirection mechanisms to open file:// URLs or request resources from private IP addresses.
Risk Assessment
In deployments where PlaywrightCapture processes untrusted URLs, an attacker could perform server-side request forgery against internal services or attempt to access local files. This could lead to the leakage of sensitive data.
Recommendation
It is recommended to upgrade to version 1.39.6 or later to mitigate this vulnerability. Additionally, review and restrict the URLs processed by PlaywrightCapture.
Other vulnerabilities in PlaywrightCapture
See all- CVE-2026-85242Medium
PlaywrightCapture contains a Server-Side Request Forgery (SSRF) vulnerability in its favicon retrieval functionality. When only_global_lookup is enabled, URL validation does not cover redirects followed by aiohttp, allowing bypass of restrictions and access to local resources.
- CVE-2026-63175High
The vulnerability in PlaywrightCapture stores capture-specific configuration and runtime data as mutable class-level variables instead of instance-level variables. This causes multiple Capture objects in the same Python process to share state, including HTTP headers, cookies, credentials, and captured request data.
Original NVD description (English source)
PlaywrightCapture is a simple replacement for splash using playwright. Prior to 1.39.6, PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses. In deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs. This vulnerability is fixed in 1.39.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS