Server-Side Request Forgery Vulnerability in Lookyloo's PlaywrightCapture

CVE-2026-73210

What is CVE-2026-73210?

A Server-Side Request Forgery (SSRF) vulnerability was present in Lookyloo's PlaywrightCapture when the only_global_lookup option was activated. This vulnerability arose from the way favicon retrieval was handled, bypassing the protective measures meant to block access to local and non-public network resources. By supplying a specially crafted favicon URL in a web page processed by PlaywrightCapture, an attacker could exploit this flaw. This would allow unauthorized interaction with internal network services, presenting risks such as internal service discovery and unintended access to confidential resources. The issue has been patched by implementing a robust URL validation process to filter out non-public addresses before making favicon requests.

References