CVE-2026-73210

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73210", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-08-11T13:59:45.731Z", "datePublished": "2026-08-11T13:59:51.006Z", "dateUpdated": "2026-08-12T18:36:28.110Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PlaywrightCapture", "repo": "https://github.com/Lookyloo/PlaywrightCapture/", "vendor": "Lookyloo", "versions": [{"lessThan": "1.40.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "Raphael Vinot"}, {"lang": "en", "type": "finder", "value": "@arpitjain099"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the <code>only_global_lookup</code> option was enabled.</p><p>PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval was performed separately from the browser request-routing protections. Favicon URLs extracted from rendered HTML were resolved and subsequently fetched directly using an <code>aiohttp.ClientSession</code>.</p><p>An attacker able to supply or control a web page processed by PlaywrightCapture could include a crafted favicon reference, for example pointing to a loopback address, private IP address, or another resource reachable only from the PlaywrightCapture host. When the page was processed, the favicon retrieval routine could issue an HTTP request to this destination despite <code>only_global_lookup</code> being enabled.</p><p>This bypass could therefore be used to make the PlaywrightCapture host interact with internal network services that should not be reachable through a capture. Depending on the targeted service and its response, this could enable internal service discovery, access to internal resources, or interaction with HTTP endpoints available only from the capture infrastructure.</p><p>The patch introduces a common URL validation routine and applies it to favicon retrieval. Direct non-global IP addresses, <code>localhost</code>, <code>.local</code> domains, malformed URLs, and other explicitly non-public destinations are rejected before the favicon request is performed.</p>This fix is a complementary fix to CVE-2026-44439 - GCVE-0-2026-44439 - GHSA-687H-XW6F-Q2QW<br>&nbsp;"}], "value": "A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the only_global_lookup option was enabled.\n\nPlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval was performed separately from the browser request-routing protections. Favicon URLs extracted from rendered HTML were resolved and subsequently fetched directly using an aiohttp.ClientSession.\n\nAn attacker able to supply or control a web page processed by PlaywrightCapture could include a crafted favicon reference, for example pointing to a loopback address, private IP address, or another resource reachable only from the PlaywrightCapture host. When the page was processed, the favicon retrieval routine could issue an HTTP request to this destination despite only_global_lookup being enabled.\n\nThis bypass could therefore be used to make the PlaywrightCapture host interact with internal network services that should not be reachable through a capture. Depending on the targeted service and its response, this could enable internal service discovery, access to internal resources, or interaction with HTTP endpoints available only from the capture infrastructure.\n\nThe patch introduces a common URL validation routine and applies it to favicon retrieval. Direct non-global IP addresses, localhost, .local domains, malformed URLs, and other explicitly non-public destinations are rejected before the favicon request is performed.\n\nThis fix is a complementary fix to CVE-2026-44439 - GCVE-0-2026-44439 - GHSA-687H-XW6F-Q2QW"}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server Side Request Forgery"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"content": {"Automatable": "Yes", "Exploitation": "None", "Technical Impact": "Partial", "Value Density": "Diffused", "version": "2.0"}, "type": "SSVCv2.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-08-11T14:06:44.206Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/Lookyloo/PlaywrightCapture/commit/5e6679717e97f7a18bb71d00a16b0876997fa10d"}], "source": {"discovery": "UNKNOWN"}, "title": "Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T18:36:14.056593Z", "id": "CVE-2026-73210", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T18:36:28.110Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73210", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T18:36:14.056593Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T18:36:18.555Z"}}], "cna": {"title": "Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "remediation developer", "value": "Raphael Vinot"}, {"lang": "en", "type": "finder", "value": "@arpitjain099"}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server Side Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"type": "SSVCv2.0", "content": {"version": "2.0", "Automatable": "Yes", "Exploitation": "None", "Value Density": "Diffused", "Technical Impact": "Partial"}}}], "affected": [{"repo": "https://github.com/Lookyloo/PlaywrightCapture/", "vendor": "Lookyloo", "product": "PlaywrightCapture", "versions": [{"status": "affected", "version": "0", "lessThan": "1.40.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/Lookyloo/PlaywrightCapture/commit/5e6679717e97f7a18bb71d00a16b0876997fa10d", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the only_global_lookup option was enabled.\n\nPlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval was performed separately from the browser request-routing protections. Favicon URLs extracted from rendered HTML were resolved and subsequently fetched directly using an aiohttp.ClientSession.\n\nAn attacker able to supply or control a web page processed by PlaywrightCapture could include a crafted favicon reference, for example pointing to a loopback address, private IP address, or another resource reachable only from the PlaywrightCapture host. When the page was processed, the favicon retrieval routine could issue an HTTP request to this destination despite only_global_lookup being enabled.\n\nThis bypass could therefore be used to make the PlaywrightCapture host interact with internal network services that should not be reachable through a capture. Depending on the targeted service and its response, this could enable internal service discovery, access to internal resources, or interaction with HTTP endpoints available only from the capture infrastructure.\n\nThe patch introduces a common URL validation routine and applies it to favicon retrieval. Direct non-global IP addresses, localhost, .local domains, malformed URLs, and other explicitly non-public destinations are rejected before the favicon request is performed.\n\nThis fix is a complementary fix to CVE-2026-44439 - GCVE-0-2026-44439 - GHSA-687H-XW6F-Q2QW", "supportingMedia": [{"type": "text/html", "value": "<p>A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the <code>only_global_lookup</code> option was enabled.</p><p>PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval was performed separately from the browser request-routing protections. Favicon URLs extracted from rendered HTML were resolved and subsequently fetched directly using an <code>aiohttp.ClientSession</code>.</p><p>An attacker able to supply or control a web page processed by PlaywrightCapture could include a crafted favicon reference, for example pointing to a loopback address, private IP address, or another resource reachable only from the PlaywrightCapture host. When the page was processed, the favicon retrieval routine could issue an HTTP request to this destination despite <code>only_global_lookup</code> being enabled.</p><p>This bypass could therefore be used to make the PlaywrightCapture host interact with internal network services that should not be reachable through a capture. Depending on the targeted service and its response, this could enable internal service discovery, access to internal resources, or interaction with HTTP endpoints available only from the capture infrastructure.</p><p>The patch introduces a common URL validation routine and applies it to favicon retrieval. Direct non-global IP addresses, <code>localhost</code>, <code>.local</code> domains, malformed URLs, and other explicitly non-public destinations are rejected before the favicon request is performed.</p>This fix is a complementary fix to CVE-2026-44439 - GCVE-0-2026-44439 - GHSA-687H-XW6F-Q2QW<br>&nbsp;", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-08-11T14:06:44.206Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73210", "state": "PUBLISHED", "dateUpdated": "2026-08-12T18:36:28.110Z", "dateReserved": "2026-08-11T13:59:45.731Z", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "datePublished": "2026-08-11T13:59:51.006Z", "assignerShortName": "CIRCL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PlaywrightCapture", "repo": "https://github.com/Lookyloo/PlaywrightCapture/", "vendor": "Lookyloo", "versions": [{"lessThan": "1.40.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the only_global_lookup option was enabled.\n\nPlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval was performed separately from the browser request-routing protections. Favicon URLs extracted from rendered HTML were resolved and subsequently fetched directly using an aiohttp.ClientSession.\n\nAn attacker able to supply or control a web page processed by PlaywrightCapture could include a crafted favicon reference, for example pointing to a loopback address, private IP address, or another resource reachable only from the PlaywrightCapture host. When the page was processed, the favicon retrieval routine could issue an HTTP request to this destination despite only_global_lookup being enabled.\n\nThis bypass could therefore be used to make the PlaywrightCapture host interact with internal network services that should not be reachable through a capture. Depending on the targeted service and its response, this could enable internal service discovery, access to internal resources, or interaction with HTTP endpoints available only from the capture infrastructure.\n\nThe patch introduces a common URL validation routine and applies it to favicon retrieval. Direct non-global IP addresses, localhost, .local domains, malformed URLs, and other explicitly non-public destinations are rejected before the favicon request is performed.\n\nThis fix is a complementary fix to CVE-2026-44439 - GCVE-0-2026-44439 - GHSA-687H-XW6F-Q2QW"}, {"lang": "es", "value": "Una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) exist\u00eda en PlaywrightCapture de Lookyloo cuando la opci\u00f3n only_global_lookup estaba habilitada.\n\nPlaywrightCapture implementa esta opci\u00f3n para evitar que las capturas accedan a recursos de red locales, de bucle invertido o de otro modo no p\u00fablicos. Sin embargo, la recuperaci\u00f3n de favicons se realizaba por separado de las protecciones de enrutamiento de peticiones del navegador. Las URL de favicon extra\u00eddas del HTML renderizado se resolv\u00edan y posteriormente se obten\u00edan directamente usando un aiohttp.ClientSession.\n\nUn atacante capaz de proporcionar o controlar una p\u00e1gina web procesada por PlaywrightCapture podr\u00eda incluir una referencia de favicon manipulada, por ejemplo, apuntando a una direcci\u00f3n de bucle invertido, direcci\u00f3n IP privada o a otro recurso accesible solo desde el host de PlaywrightCapture. Cuando la p\u00e1gina era procesada, la rutina de recuperaci\u00f3n de favicons pod\u00eda emitir una petici\u00f3n HTTP a este destino a pesar de que only_global_lookup estuviera habilitado.\n\nEste bypass podr\u00eda, por lo tanto, ser utilizado para hacer que el host de PlaywrightCapture interact\u00fae con servicios de red internos que no deber\u00edan ser accesibles a trav\u00e9s de una captura. Dependiendo del servicio objetivo y su respuesta, esto podr\u00eda permitir el descubrimiento de servicios internos, el acceso a recursos internos o la interacci\u00f3n con puntos finales HTTP disponibles solo desde la infraestructura de captura.\n\nEl parche introduce una rutina com\u00fan de validaci\u00f3n de URL y la aplica a la recuperaci\u00f3n de favicons. Direcciones IP no globales directas, localhost, dominios .local, URL malformadas y otros destinos expl\u00edcitamente no p\u00fablicos son rechazados antes de que se realice la petici\u00f3n de favicon.\n\nEsta correcci\u00f3n es una correcci\u00f3n complementaria a CVE-2026-44439 - GCVE-0-2026-44439 - GHSA-687H-XW6F-Q2QW"}], "id": "CVE-2026-73210", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73210", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T18:36:14.056593Z", "version": "2.0.3"}}]}, "published": "2026-08-11T14:17:16.070", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/Lookyloo/PlaywrightCapture/commit/5e6679717e97f7a18bb71d00a16b0876997fa10d"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.40.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PlaywrightCapture", "source": "cna", "vendor": "Lookyloo"}, "product": "playwrightcapture", "vendor": "lookyloo"}], "created": "2026-08-11T23:15:13.098254+00:00", "updated": "2026-08-11T23:45:04.586743+00:00", "vendors": ["lookyloo", "lookyloo$PRODUCT$playwrightcapture"]}