A Server‑Side Request Forgery flaw allowed an attacker who can supply or control a web page processed by PlaywrightCapture to force the system to request a favicon from a target URL. The vulnerability arises because favicon retrieval bypasses the only_global_lookup option that normally blocks non‑public network requests. By crafting a favicon reference to a loopback address, private IP, or otherwise internal resource, the attacker can cause the PlaywrightCapture host to reach services that should remain isolated. Depending on the response from the internal service, this may enable discovery of internal hosts, access to internal resources, or interaction with HTTP endpoints only reachable from the capture infrastructure.

The vulnerability affects the Lookyloo PlaywrightCapture component. No specific version information was provided; any deployment where the only_global_lookup option is enabled and favicon retrieval is performed is potentially impacted.

The CVSS score of 5.1 indicates a moderate severity. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog. Exploitability requires the ability to dictate the HTML page that PlaywrightCapture processes; therefore, the attack vector is likely to be remote if the capture system accepts externally supplied pages or local if an attacker becomes a user of the system. The patch adds a URL validation routine that rejects non‑global IP addresses, localhost, .local domains, malformed URLs, and other explicitly non‑public destinations before the favicon request is performed, mitigating the vulnerability.