Server-Side Request Forgery in PlaywrightCapture's Favicon Functionality
CVE-2026-85242

6.9MEDIUM

Key Information:

Vendor

Lookyloo

Status
Playwrightcapture
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85242?

PlaywrightCapture has a server-side request forgery (SSRF) vulnerability affecting the favicon retrieval feature. When the only_global_lookup option is enabled, the initial favicon URL is validated against localhost and other restricted addresses. However, subsequent HTTP redirects managed by aiohttp may bypass this validation, allowing an attacker to manipulate requests to sensitive internal resources from a publicly accessible URL. This vulnerability can lead to unauthorized probing of internal services or exposure of sensitive data, necessitating immediate attention and remediation through a security patch that enhances request validation across all redirect stages.

Affected Version(s)

PlaywrightCapture 0

References

https://github.com/Lookyloo/PlaywrightCapture/commit/b912...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Raphael Vinot
Grant - avrlab233
.