CVE-2024-39919 Capture screenshot of localhost web services (unauthenticated pages) in @jmondi/url-to-png

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an ALLOWLIST where the host can specify which services the user is permitted to capture screenshots of. By...

CVE-2024-39918

CVE-2024-39918 affects @jmondi/url-to-png. The root cause is lack of sanitization in the ImageId input (extract_query_params.ts), enabling path traversal that lets an attacker store a generated PNG in arbitrary server-accessible locations. Public disclosures across NVD/Red Hat/OSV/Veracode indica...

CVE-2024-39918 Path Traveral in @jmondi/url-to-png

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the ImageId in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in ...

CVE-2024-39918 Path Traveral in @jmondi/url-to-png

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the ImageId in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in ...

Malicious code in @tabby.ai/qaseio-playwright-reporter (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2906 Malicious code in @tabby.ai/qaseio-playwright-reporter (npm)

--- -= Per source details. Do not edit below this line.=-...

URL to PNG Security Vulnerability

URL to PNG is an application by Jason Raimondi Personal Developer. A security vulnerability exists in URL to PNG prior to version 2.0.3, which originates from the ability to read arbitrary files via a file wrapper via Playwright's screenshot feature...

Arbitrary file read via Playwright's screenshot feature exploiting file wrapper

Impact All users of url-to-png. Please see https://github.com/jasonraimondi/url-to-png/issues/47 Patches v2.0.3 requires input url to be of protocol http or https Workarounds Requires upgrade. References - https://github.com/jasonraimondi/url-to-png/issues/47 -...

Malicious code in playwright-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c44aadbfa206dce3a9b475d92ce277e6db2e0b0e1d8a3781be36355ea3ad4cfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8277 Malicious code in playwright-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c44aadbfa206dce3a9b475d92ce277e6db2e0b0e1d8a3781be36355ea3ad4cfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in playwright.dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37b4aef0ce9f3bbd5c55675cd7eb07e8f66431b0b3e1784a6b820efb3a43fd73 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ui-test-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e546ffc456cdd216967ecffe0f0d9182e4ee1b4314653099318c5cdd533443e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6758 Malicious code in ui-test-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e546ffc456cdd216967ecffe0f0d9182e4ee1b4314653099318c5cdd533443e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...