EUVD-2026-56151Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector, no auth required from attacker; operator must process a page (UI:R); scope changes to internal systems (S:C); low C/I reflecting SSRF service probing with no availability impact.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the only_global_lookup option was enabled.
PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval was performed separately from the browser request-routing protections. Favicon URLs extracted from rendered HTML were resolved and subsequently fetched directly using an aiohttp.ClientSession.
An attacker able to supply or control a web page processed by PlaywrightCapture could include a crafted favicon reference, for example pointing to a loopback address, private IP address, or another resource reachable only from the PlaywrightCapture host. When the page was processed, the favicon retrieval routine could issue an HTTP request to this destination despite only_global_lookup being enabled.
This bypass could therefore be used to make the PlaywrightCapture host interact with internal network services that should not be reachable through a capture. Depending on the targeted service and its response, this could enable internal service discovery, access to internal resources, or interaction with HTTP endpoints available only from the capture infrastructure.
The patch introduces a common URL validation routine and applies it to favicon retrieval. Direct non-global IP addresses, localhost, .local domains, malformed URLs, and other explicitly non-public destinations are rejected before the favicon request is performed.
AnalysisAI
PlaywrightCapture's only_global_lookup SSRF protection is bypassed during favicon retrieval, allowing an attacker who can supply a web page for processing to direct the capture host's aiohttp HTTP client against loopback addresses, private IP ranges, or internal DNS names. The bypass arises because favicon URLs parsed from rendered HTML were fetched via a separate aiohttp.ClientSession that did not consult the same IP and hostname validation logic applied to browser-routed Playwright requests. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the only_global_lookup option is enabled in PlaywrightCapture configuration - without this option active, there is no protection in place to bypass and the SSRF risk exists independently of this specific flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 with vector AV:N/AC:L/AT:N/PR:N/UI:A accurately reflects the genuine exploitation constraint: an operator or automated process must initiate a capture of an attacker-controlled URL for the favicon bypass to fire, which meaningfully limits opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a URL pointing to an attacker-controlled page to a Lookyloo instance running a vulnerable PlaywrightCapture version with only_global_lookup enabled. The attacker's page includes an HTML link tag referencing a favicon at an internal target such as http://169.254.169.254/latest/meta-data/ or an internal management interface address. … |
| Remediation | The primary remediation is to update PlaywrightCapture to a version incorporating commit 5e6679717e97f7a18bb71d00a16b0876997fa10d (https://github.com/Lookyloo/PlaywrightCapture/commit/5e6679717e97f7a18bb71d00a16b0876997fa10d), which introduces the shared __check_local_url() validation method applied to favicon retrieval. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Playwrightcapture
View allSame weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today