CVE-2026-63175

Name of the Vulnerable Software and Affected Versions PlaywrightCapture (affected versions not specified)

Description PlaywrightCapture stored configuration and runtime data as mutable class-level variables instead of instance-level variables. This allows multiple Capture objects within the same Python process to share state, including HTTP headers, cookies, browser storage, HTTP credentials, proxy configuration, user-agent settings, geolocation information, and captured request data. In concurrent or multi-user deployments, data from one capture can persist and be reused by others, potentially leading to the disclosure of authentication cookies, credentials, or browser storage. This may also allow requests to be executed using another capture's authentication context or proxy configuration, enabling unauthorized access to remote resources.

Recommendations Initialize all capture-specific settings and request data as instance variables in the Capture constructor to ensure state isolation between operations.