The vulnerability in spatie/browsershot prior to version 5.0.5 arises from insufficient validation of user input in the setHtml function, invoked via Browsershot::html(). Specifically, the function fails to block file URI schemes properly, allowing attackers to bypass intended restrictions by omitting slashes in the file URI. This improper input validation can lead to unintended file access or processing. Despite identification and proof-of-concept exploits, no official fix or patch has been released yet.

This vulnerability has a high severity CVSS score of 8.8 and allows remote attackers to bypass input validation controls without authentication or user interaction. The improper handling of file URI schemes could enable attackers to access or manipulate local files or HTML content in unintended ways, potentially leading to information disclosure or other security impacts. No known exploits in the wild have been reported so far.

As no official patch or remediation is currently available, developers using spatie/browsershot versions prior to 5.0.5 should implement their own input validation to block or sanitize file URI schemes, including variants that omit slashes. Monitoring vendor advisories for an official fix is recommended. Avoid using vulnerable versions in production environments until a patch is released.