Lookyloo PlaywrightCapture up to 1.41.1 Favicon Retrieval server-side request forgery

Summaryinfo

A vulnerability classified as problematic was found in Lookyloo PlaywrightCapture up to 1.41.1. Impacted is an unknown function of the component Favicon Retrieval. Executing a manipulation can lead to server-side request forgery. The identification of this vulnerability is CVE-2026-85242. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in Lookyloo PlaywrightCapture up to 1.41.1 and classified as problematic. This vulnerability affects an unknown function of the component Favicon Retrieval. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality. CVE summarizes:

PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality. When only_global_lookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However, redirects followed by aiohttp were not subjected to the same validation. An attacker able to influence the content of a page processed by PlaywrightCapture could specify a publicly reachable favicon URL that responds with an HTTP redirect to a local or otherwise restricted address, such as 127.0.0.1, localhost, or an internal network service. Because aiohttp automatically followed the redirect, the resulting request could bypass the application's local-address restrictions and cause the PlaywrightCapture host to issue HTTP requests to resources that should not be externally reachable. Depending on the services reachable from the PlaywrightCapture host and how retrieved favicon data is subsequently exposed or processed, this could be used to probe internal HTTP services or potentially obtain information from otherwise inaccessible endpoints. The patch introduces an aiohttp request middleware that applies the existing local-URL validation to every request in the redirect chain. Requests resolving to restricted/local destinations are rejected before they are issued.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-85242 since 09/03/2026. The exploitation appears to be easy. The attack can be initiated remotely. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.41.2 eliminates this vulnerability. Applying the patch b912a04f7b190807b5e14e497048896bc5016fb9 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Lookyloo

Name

• PlaywrightCapture

Version

• 1.41.0
• 1.41.1

Website

• Product: https://github.com/Lookyloo/PlaywrightCapture/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion