PT-2026-38317 · Microsoft · Playwrightcapture

Jeroengui · Published 2026-05-06 · Updated 2026-05-14 · CVE-2026-44439

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Playwright Capture (affected versions not specified)

Description Playwright Capture fails to sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page can abuse browser-side redirection mechanisms, such as window.location.href, to force the capture process to open 'file://' URLs or request resources from private, loopback, link-local, or non-public IP addresses. This can lead to Server-Side Request Forgery (SSRF), where a remote attacker performs requests against internal services or accesses local files from the capture environment. Depending on the generated artifacts, responses from these resources may be leaked via screenshots, saved page content, or logs.

Recommendations Apply the patch that introduces request routing checks to block secondary requests to local files, non-global IP addresses, and .local domains when only global lookup is enabled.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-44439

GHSA-687H-XW6F-Q2QW

Affected Products

Playwrightcapture

References · 9

• https://github.com/Lookyloo/PlaywrightCapture/commit/49e289eba756e4fbac1322c33cfd111411562405 · Patch
• https://github.com/Lookyloo/PlaywrightCapture/security/advisories/GHSA-687h-xw6f-q2qw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-687h-xw6f-q2qw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44439 · Security Note
• https://github.com/Lookyloo/PlaywrightCapture · Note
• https://twitter.com/VulmonFeeds/status/2054811669998522466 · Twitter Post
• https://t.me/CVEtracker/53717 · Telegram Post
• https://twitter.com/dailycve/status/2052228599239868579 · Twitter Post
• https://twitter.com/CVEnew/status/2054709188245488089 · Twitter Post