CVE-2026-85242 in PlaywrightCapture
Summary
by MITRE • 09/03/2026
PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality. When only_global_lookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However, redirects followed by aiohttp were not subjected to the same validation.
An attacker able to influence the content of a page processed by PlaywrightCapture could specify a publicly reachable favicon URL that responds with an HTTP redirect to a local or otherwise restricted address, such as 127.0.0.1, localhost, or an internal network service. Because aiohttp automatically followed the redirect, the resulting request could bypass the application's local-address restrictions and cause the PlaywrightCapture host to issue HTTP requests to resources that should not be externally reachable.
Depending on the services reachable from the PlaywrightCapture host and how retrieved favicon data is subsequently exposed or processed, this could be used to probe internal HTTP services or potentially obtain information from otherwise inaccessible endpoints.
The patch introduces an aiohttp request middleware that applies the existing local-URL validation to every request in the redirect chain. Requests resolving to restricted/local destinations are rejected before they are issued.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/03/2026
PlaywrightCapture contains a server-side request forgery vulnerability within its favicon retrieval functionality, stemming from incomplete input validation during HTTP redirect handling. The application implements security controls designed to prevent SSRF attacks by validating the initial URL provided for favicon fetching. Specifically, when the only_global_lookup configuration option is enabled, the system checks whether the target address corresponds to localhost, loopback interfaces, or other non-public network ranges before initiating a connection. This validation mechanism serves as a critical defense layer intended to restrict outbound requests from the server to internal resources that should remain inaccessible from external contexts. However, this security control was only applied to the initial URL and failed to account for subsequent redirects issued by remote servers during the request lifecycle.
The technical flaw arises because the underlying HTTP client library, aiohttp, automatically follows HTTP redirect responses without re-evaluating the destination against local-address restrictions. An attacker who can influence the content of a page processed by PlaywrightCapture can specify a publicly reachable favicon URL that is under their control or compromised. This external server responds with an HTTP redirect status code pointing to a restricted internal address, such as 127.0.0.1, localhost, or specific ports on private network services. Because the application does not validate these intermediate destinations, aiohttp proceeds to follow the redirect and issues the final request from the PlaywrightCapture host to the targeted internal resource. This behavior effectively bypasses the intended local-address filtering logic, allowing external actors to force the server to communicate with internal infrastructure that was meant to be isolated.
The operational impact of this vulnerability allows an attacker to probe internal HTTP services or extract sensitive information from endpoints that are not directly exposed to the public internet. By manipulating the redirect chain, the attacker can determine the availability and behavior of internal applications based on response codes, content differences, or timing variations. This capability facilitates reconnaissance against backend systems, potentially revealing service versions, authentication mechanisms, or other configuration details. In scenarios where these internal services handle sensitive data or perform privileged operations, the SSRF could lead to further exploitation vectors such as unauthorized access to administrative interfaces or injection of malicious payloads into internal APIs. The severity is compounded by the fact that favicon retrieval is often a routine operation performed on every page load, increasing the attack surface and frequency with which this vulnerability can be triggered.
This issue aligns with CWE-918, Server-Side Request Forgery (SSRF), specifically reflecting weaknesses in URL validation logic where redirect handling is not secured. It also maps to MITRE ATT&CK technique T1571, Non-Standard Port, if the attacker targets internal services on non-standard ports, or generally falls under SSRF-based reconnaissance activities that enable lateral movement within a network environment. The vulnerability highlights a common oversight in web application development where security controls are applied at the entry point but not enforced throughout the entire request processing pipeline, particularly when dealing with stateful client behaviors like automatic redirect following.
The remediation for this vulnerability involves implementing an aiohttp request middleware that enforces local-URL validation on every step of the redirect chain rather than solely on the initial URL. This patch ensures that each intermediate destination is checked against the same set of restricted addresses before a connection attempt is made. Requests resolving to localhost, loopback interfaces, or other non-public network ranges are rejected immediately during the redirection process. By applying consistent validation logic across all hops in the HTTP transaction, the application closes the bypass vector and restores the integrity of its SSRF protections. Organizations using PlaywrightCapture should apply this patch promptly and review their own implementations of favicon retrieval to ensure that redirect handling is similarly secured against internal network access.