Url To Png
Approved changes feed: RSS · Atom
cpe:2.3:a:jasonraimondi:url-to-png:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Jasonraimondi (d7553d70-614b-536b-a33a-12609d295274) |
|---|---|
| Product | Url To Png (84b54262-6221-501b-a7bb-ac201f9d260c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-39919 |
vulnerable | 2026-06-08 06:41:51.838516 |
Capture screenshot of localhost web services (unauthenticated pages) in @jmondi/url-to-png
LOW (3.1)
@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an `ALLOW_LIST` where the host can specify which services the user is permitted to capture screenshots of. By default, capturing screenshots of web services running on localhost, 127.0.0.1, or the [::] is allowed. If someone hosts this project on a server, users could then capture screenshots of other web services running locally. This issue has been addressed in version 2.1.1 with the addition of a blocklist. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2024-07-15T19:53:23.192Z
Updated: 2024-08-02T04:33:11.149Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39918 |
vulnerable | 2026-06-08 06:41:51.837124 |
Path Traveral in @jmondi/url-to-png
MEDIUM (4.3)
@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the `ImageId` in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in an arbitrary location that the server has permission to access. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2024-07-15T19:53:20.491Z
Updated: 2024-08-02T04:33:11.660Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37169 |
vulnerable | 2026-06-08 06:39:46.749122 |
@jmondi/url-to-png arbitrary file read via Playwright's screenshot feature exploiting file wrapper
MEDIUM (5.3)
@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol `http` or `https`. No known workarounds are available aside from upgrading.
Published: 2024-06-10T21:35:38.198Z
Updated: 2024-08-02T03:50:55.256Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.