PlaywrightCapture contains a server‑side request forgery vulnerability in its favicon retrieval path. When only_global_lookup is enabled, the tool accepts a publicly reachable favicon URL, follows an HTTP redirect via aiohttp, and does not re‑validate the target of the redirect. This allows an attacker to cause the PlaywrightCapture host to send HTTP requests to addresses that should be blocked, such as 127.0.0.1, localhost, or other internal services. The result is that internal endpoints may be probed or data from those services may be exposed to the attacker.

The affected product is Lookyloo’s PlaywrightCapture. No specific version information is present in this CVE entry; the issue exists in any code base that has not applied the commit referenced, which introduces a middleware to reject redirects to local addresses.

The severity, as indicated by a CVSS score of 6.9, reflects a moderate risk. Because the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, a clear exploitation trend is not evident, but the SSRF scenario is feasible if an attacker can influence the page content that PlaywrightCapture processes. The exploitation would require the attacker to supply a crafted favicon URL that redirects to a restricted address; no additional system credentials or privileges are needed.