{"id":"CVE-2024-37169","aliases":["EUVD-2024-1941","GHSA-665w-mwrr-77q3"],"status":"published","title":"@jmondi/url-to-png arbitrary file read via Playwright's screenshot feature exploiting file wrapper","description":"@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol `http` or `https`. No known workarounds are available aside from upgrading.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00529,"percentile":0.45209,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-06-05T13:29:10Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"npm","package":"@jmondi/url-to-png","fixed_in":["2.0.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@jmondi/url-to-png","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"@jmondi/url-to-png","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.3"}]}]}],"products":[{"vendor":"jasonraimondi","product":"url-to-png"}],"references":[{"url":"https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-665w-mwrr-77q3","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://github.com/jasonraimondi/url-to-png/issues/47","tags":["x_refsource_MISC","x_transferred","report","web"]},{"url":"https://github.com/jasonraimondi/url-to-png/commit/9336020c5e603323f5cf4a2ac3bb9a7735cf61f7","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/jasonraimondi/url-to-png/releases/tag/v2.0.3","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/user-attachments/files/15536336/Arbitrary.File.Read.via.Playwright.s.Screenshot.Feature.Exploiting.File.Wrapper.pdf","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37169","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-665w-mwrr-77q3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37169.json","tags":["advisory"]},{"url":"https://github.com/jasonraimondi/url-to-png","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-37169","title":"@jmondi/url-to-png arbitrary file read via Playwright's screenshot feature exploiting file wrapper","description":"@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol `http` or `https`. No known workarounds are available aside from upgrading.","status":"published","published":"2024-06-10T21:35:38.198Z","modified":"2024-08-02T03:50:55.256Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:00.929382Z"}],"euvd":[{"id":"EUVD-2024-1941","description":"@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol `http` or `https`. No known workarounds are available aside from upgrading.","status":"published","published":"2024-06-10T21:35:38Z","modified":"2024-08-02T03:50:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:19.46851Z"}],"ghsa":[{"id":"GHSA-665w-mwrr-77q3","title":"Arbitrary file read via Playwright's screenshot feature exploiting file wrapper","description":"### Impact\n\nAll users of url-to-png. Please see https://github.com/jasonraimondi/url-to-png/issues/47\n\n### Patches\n\n[v2.0.3](https://github.com/jasonraimondi/url-to-png/releases/tag/v2.0.3) requires input url to be of protocol `http` or `https` \n\n### Workarounds\n\nRequires upgrade.\n\n### References\n\n- https://github.com/jasonraimondi/url-to-png/issues/47\n- https://github.com/user-attachments/files/15536336/Arbitrary.File.Read.via.Playwright.s.Screenshot.Feature.Exploiting.File.Wrapper.pdf\n","status":"published","published":"2024-06-05T13:29:10Z","modified":"2024-06-11T18:27:02Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:54.624184Z"}],"nvd":[{"id":"CVE-2024-37169","description":"@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol `http` or `https`. No known workarounds are available aside from upgrading.","status":"published","published":"2024-06-10T22:15:12.663Z","modified":"2026-06-17T07:37:53.22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:04.804473Z"}],"osv":[{"id":"CVE-2024-37169","title":"@jmondi/url-to-png arbitrary file read via Playwright's screenshot feature exploiting file wrapper","description":"@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol `http` or `https`. No known workarounds are available aside from upgrading.","status":"published","published":"2024-06-10T21:35:38.198Z","modified":"2026-10-28T02:31:09.962602005Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:41.133403Z"},{"id":"GHSA-665w-mwrr-77q3","title":"Arbitrary file read via Playwright's screenshot feature exploiting file wrapper","description":"### Impact\n\nAll users of url-to-png. Please see https://github.com/jasonraimondi/url-to-png/issues/47\n\n### Patches\n\n[v2.0.3](https://github.com/jasonraimondi/url-to-png/releases/tag/v2.0.3) requires input url to be of protocol `http` or `https` \n\n### Workarounds\n\nRequires upgrade.\n\n### References\n\n- https://github.com/jasonraimondi/url-to-png/issues/47\n- https://github.com/user-attachments/files/15536336/Arbitrary.File.Read.via.Playwright.s.Screenshot.Feature.Exploiting.File.Wrapper.pdf\n","status":"published","published":"2024-06-05T13:29:10Z","modified":"2026-09-10T03:50:14.979126354Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:39.266402Z"}]}}