CVE-2026-63175

HighCVSS 7.1

Published: 15/07/2026(UTC)Updated: 16/07/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

The vulnerability in PlaywrightCapture stores capture-specific configuration and runtime data as mutable class-level variables instead of instance-level variables. This causes multiple Capture objects in the same Python process to share state, including HTTP headers, cookies, credentials, and captured request data.

Risk Assessment

The risk includes disclosure of authentication cookies, credentials, or captured request data between users in a multi-tenant environment. It may also lead to unauthorized access to remote resources due to shared authentication context or proxy configuration.

Recommendation

Immediately update PlaywrightCapture to a version where all capture-specific settings are initialized as instance variables in the Capture constructor. This ensures state isolation between capture operations.

Other vulnerabilities in PlaywrightCapture

CVE-2026-44439High
Prior to version 1.39.6, PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could exploit redirection mechanisms to open file:// URLs or request resources from private IP addresses.

Original NVD description (English source)

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state, including HTTP headers, cookies, browser storage, HTTP credentials, proxy configuration, user-agent settings, geolocation information, and captured request data. In a multi-user or concurrent deployment, information supplied during one capture could therefore persist and be reused by a subsequent or parallel capture. This could result in the disclosure of authentication cookies, credentials, browser storage, or captured request data belonging to another user. It could also cause requests to be performed with another capture's authentication context, headers, or proxy configuration, potentially enabling unauthorized access to remote resources or interference with other capture operations. The vulnerability is resolved by initializing all capture-specific settings and request data as instance variables in the Capture constructor, ensuring that state is isolated between capture operations.