CVE-2026-44439 json
LookyLoo - PlaywrightCapture permits access to local files and internal network resources during page capture
published 2026-05-06 6 mo ago modified 2026-10-26 14 d ago also GHSA-687h-xw6f-q2qw , PYSEC-2026-2259 , EUVD-2026-30192
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
PlaywrightCapture is a simple replacement for splash using playwright. Prior to 1.39.6, PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses. In deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs. This vulnerability is fixed in 1.39.6.
Patch / fix
- pypi playwrightcapture 1.39.6
- lookyloo playwright_capture 1.39.6
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U |
| CNA | 4.0 | 6.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | playwrightcapture | <1.39.6 |
1.39.6 |
Affected products
- Lookyloo PlaywrightCapture
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/Lookyloo/PlaywrightCapture/commit/49e289eba756e4fbac1322c33cfd111411562405
web, patch
-
github.com
/Lookyloo/PlaywrightCapture/security/advisories/GHSA-687h-xw6f-q2qw
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-44439
advisory
-
github.com
/Lookyloo/PlaywrightCapture
package
Sources
- CVE List CVE-2026-44439
- GitHub Advisory GHSA-687h-xw6f-q2qw
- NVD CVE-2026-44439
- OSV PYSEC-2026-2259
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.