CVE-2024-37169

@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol http or https. ...

CVE-2024-37169

@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol http or https. ...

PT-2024-27353

Name of the Vulnerable Software and Affected Versions @jmondi/url-to-png versions prior to 2.0.3 Description The issue allows for arbitrary file read if a threat actor uses Playright's screenshot feature to exploit the file wrapper. No known workarounds are available aside from upgrading. The...