CVE-2026-73210 in PlaywrightCapture
Summary
by MITRE • 08/11/2026
A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the only_global_lookup option was enabled.
PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval was performed separately from the browser request-routing protections. Favicon URLs extracted from rendered HTML were resolved and subsequently fetched directly using an aiohttp.ClientSession.
An attacker able to supply or control a web page processed by PlaywrightCapture could include a crafted favicon reference, for example pointing to a loopback address, private IP address, or another resource reachable only from the PlaywrightCapture host. When the page was processed, the favicon retrieval routine could issue an HTTP request to this destination despite only_global_lookup being enabled.
This bypass could therefore be used to make the PlaywrightCapture host interact with internal network services that should not be reachable through a capture. Depending on the targeted service and its response, this could enable internal service discovery, access to internal resources, or interaction with HTTP endpoints available only from the capture infrastructure.
The patch introduces a common URL validation routine and applies it to favicon retrieval. Direct non-global IP addresses, localhost, .local domains, malformed URLs, and other explicitly non-public destinations are rejected before the favicon request is performed.
This fix is a complementary fix to CVE-2026-44439 - GCVE-0-2026-44439 - GHSA-687H-XW6F-Q2QW
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The Server-Side Request Forgery vulnerability in Lookyloo's PlaywrightCapture represents a critical security flaw that undermines the intended network isolation mechanisms of the capture system. This vulnerability specifically manifests when the only_global_lookup option is enabled, which is designed to prevent captures from accessing local, loopback, or non-public network resources. The implementation fails to consistently enforce these restrictions across all components of the capture process, creating an exploitable gap in the security model that directly contradicts the fundamental principle of network segmentation in secure web scraping and content capture systems.
The technical flaw stems from the separate handling of favicon retrieval operations within the PlaywrightCapture module. While the main browser request-routing protections successfully block direct access to internal resources through the primary capture mechanism, the favicon fetching process operates independently using an aiohttp.ClientSession without applying the same restrictive validation. This architectural inconsistency creates a bypass path that allows attackers to circumvent the intended security controls by embedding malicious favicon references in web pages processed by the system. The vulnerability is particularly dangerous because it leverages legitimate browser rendering processes to execute unauthorized network requests, making detection more challenging and exploitability more straightforward.
The operational impact of this vulnerability extends beyond simple information disclosure, potentially enabling comprehensive internal service discovery and unauthorized access to sensitive resources within the capture infrastructure's network environment. Attackers can exploit this weakness to probe internal services, discover running applications, or even interact with HTTP endpoints that should remain isolated from external access. The implications are particularly severe in environments where PlaywrightCapture operates on systems with access to sensitive internal networks, as it could provide an attacker with a foothold for further reconnaissance or lateral movement within the network infrastructure.
The mitigation implemented addresses this vulnerability by introducing a comprehensive URL validation routine that specifically targets the favicon retrieval process. This fix ensures that before any favicon request is executed, the system performs strict validation against known non-public destinations including direct IP addresses, localhost references, .local domain names, and malformed URLs. The solution follows established security principles for preventing SSRF attacks while aligning with industry standards such as CWE-918 which specifically addresses server-side request forgery vulnerabilities. This remediation represents a defensive programming approach that ensures consistency in security controls across all network access points within the application, thereby strengthening the overall security posture of the Lookyloo capture system.
The vulnerability and its fix are directly related to CVE-2026-44439, indicating this is part of a broader security assessment that identified multiple interconnected issues within the PlaywrightCapture module. The complementary nature of these fixes demonstrates the importance of comprehensive security testing and validation across all components of complex web scraping systems. This vulnerability serves as a prime example of how seemingly minor architectural inconsistencies can create significant security risks in applications designed for network isolation and secure content capture, emphasizing the critical need for thorough security reviews of all code paths that handle external resource requests.