CVE-2026-85242

Name of the Vulnerable Software and Affected Versions PlaywrightCapture (affected versions not specified)

Description An issue exists in the favicon retrieval functionality where the application fails to validate redirects when only global lookup is enabled. While the initial favicon URL is checked to prevent requests to localhost, loopback, or non-public network addresses, subsequent redirects handled by aiohttp bypass this validation. An attacker can provide a public URL that redirects to a restricted internal address, such as 127.0.0.1 or localhost, causing the host to issue unauthorized HTTP requests. This can be used to probe internal HTTP services or extract information from inaccessible endpoints.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.