PlaywrightCapture, a tool for rendering web pages using Playwright, failed to limit navigation and resource requests before version 1.39.6. An attacker‑controlled page can redirect the capture process to file:// URLs or to non‑public IPs, allowing server‑side request forgery against internal services or local file read attempts. If the capture output is later viewed, data from those internal or local resources could be exposed through screenshots, saved page content, logs, or other artifacts.

The vulnerability affects Lookyloo’s PlaywrightCapture component. All releases prior to 1.39.6 are vulnerable; applying the 1.39.6 update or later removes the flaw.

With a CVSS score of 6.6 the weakness is considered medium severity, and it is not listed in the CISA KEV catalog. The EPSS is not available, so current exploit likelihood is unknown, but environments that process untrusted URLs are the primary risk area. An attacker could trigger internal requests or local file enumeration, potentially leaking sensitive data into exposed artifacts.