CVE-2026-85242: CWE-918 Server-Side Request Forgery (SSRF) in Lookyloo PlaywrightCapture

CVE-2026-85242 is a server-side request forgery (SSRF) vulnerability in Lookyloo's PlaywrightCapture component affecting favicon retrieval. When only_global_lookup is enabled, initial favicon URLs are validated to prevent requests to localhost, loopback, or non-public network addresses. However, HTTP redirects followed by aiohttp were not validated, allowing attackers to specify a public favicon URL that redirects to a local or restricted address. Because aiohttp automatically follows redirects without validation, the PlaywrightCapture host can be tricked into making unauthorized HTTP requests to internal services. The vulnerability could be used to probe or extract information from internal endpoints. The patch adds aiohttp request middleware to validate all URLs in the redirect chain and reject requests to restricted destinations before they are issued.

An attacker able to influence the content of a page processed by PlaywrightCapture can cause the host to make HTTP requests to internal or restricted network addresses via redirect chains in favicon URLs. This bypasses local-address restrictions and may allow internal network probing or information disclosure from otherwise inaccessible services. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality.

No official patch or remediation level has been confirmed yet. The vendor has introduced a patch that adds middleware to validate all URLs in redirect chains to prevent SSRF via redirects. Users should upgrade to PlaywrightCapture version 1.41.2 or later once available. Until then, restrict exposure of PlaywrightCapture to untrusted inputs or networks and monitor for unusual internal HTTP requests. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.