CVE-2026-85242
Received Received - Intake

SSRF in PlaywrightCapture via Unvalidated Redirects

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: CIRCL

Description
PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality. When only_global_lookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However, redirects followed by aiohttp were not subjected to the same validation. An attacker able to influence the content of a page processed by PlaywrightCapture could specify a publicly reachable favicon URL that responds with an HTTP redirect to a local or otherwise restricted address, such as 127.0.0.1, localhost, or an internal network service. Because aiohttp automatically followed the redirect, the resulting request could bypass the application's local-address restrictions and cause the PlaywrightCapture host to issue HTTP requests to resources that should not be externally reachable. Depending on the services reachable from the PlaywrightCapture host and how retrieved favicon data is subsequently exposed or processed, this could be used to probe internal HTTP services or potentially obtain information from otherwise inaccessible endpoints. The patch introduces an aiohttp request middleware that applies the existing local-URL validation to every request in the redirect chain. Requests resolving to restricted/local destinations are rejected before they are issued.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85242
EUVD
EUVD-2026-70598

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
playwrightcapture playwrightcapture *
lookyloo playwrightcapture *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

PlaywrightCapture has a server-side request forgery (SSRF) vulnerability in its favicon retrieval. When enabled, the app checks initial favicon URLs to block requests to localhost or private networks. However, aiohttp redirects were not validated, allowing attackers to specify a public URL that redirects to a restricted address like 127.0.0.1. aiohttp would follow the redirect, bypassing restrictions and letting the host make unauthorized requests to internal services.

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected requests to localhost or internal network addresses originating from PlaywrightCapture processes. Check logs for favicon retrieval attempts that follow redirects to restricted addresses. Use tools like tcpdump or Wireshark to capture outbound HTTP requests from the PlaywrightCapture host.

Impact Analysis

An attacker could probe internal HTTP services or access otherwise restricted endpoints by tricking PlaywrightCapture into following malicious redirects. This may expose sensitive data or internal network details if the host can reach such services.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to internal network services through SSRF. If exploited, it may allow attackers to probe or retrieve data from restricted endpoints, which could include sensitive personal or health information. This violates principles of data protection and access control required by these regulations.

Mitigation Strategies
  • Update PlaywrightCapture to the patched version that includes the aiohttp request middleware for local-URL validation.
  • Disable the only_global_lookup feature if it is not required, as it was part of the vulnerable functionality.
  • Implement network-level restrictions to block outbound requests to localhost or internal network ranges from the PlaywrightCapture host.
  • Review and restrict access to internal services that could be probed via this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85242. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart