PlaywrightCapture before version 1.39.6 insufficiently restricts navigation and resource requests initiated by rendered pages during capture. An attacker can exploit browser-side redirection mechanisms such as window.location.href to cause the capture process to open file:// URLs or request resources on private, loopback, link-local, or non-public IP addresses. This SSRF vulnerability could allow attackers to access internal services or local files from the capture environment. Depending on the artifacts generated (screenshots, saved content, logs), sensitive information from these internal resources could be leaked. The issue is resolved in PlaywrightCapture 1.39.6.

An attacker controlling a URL processed by vulnerable PlaywrightCapture instances can cause the capture process to make unauthorized requests to internal or local resources, potentially exposing sensitive data through capture artifacts. This could lead to information disclosure from internal services or local files. The CVSS 4.0 base score is 6.6 (medium severity), reflecting network attack vector, no privileges or user interaction required, but high impact on confidentiality.

This vulnerability is fixed in PlaywrightCapture version 1.39.6. Users should upgrade to version 1.39.6 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor advisory stating the fix is included in version 1.39.6.