VDB
Sign up
MEDIUM5.3

GHSA-665w-mwrr-77q3

Arbitrary file read via Playwright's screenshot feature exploiting file wrapper

Quick fix

GHSA-665w-mwrr-77q3 — @jmondi/url-to-png: upgrade to the fixed version with the command below.

npm install @jmondi/url-to-png@2.0.3

Details

### Impact

All users of url-to-png. Please see https://github.com/jasonraimondi/url-to-png/issues/47

### Patches

[v2.0.3](https://github.com/jasonraimondi/url-to-png/releases/tag/v2.0.3) requires input url to be of protocol `http` or `https`

### Workarounds

Requires upgrade.

### References

- https://github.com/jasonraimondi/url-to-png/issues/47 - https://github.com/user-attachments/files/15536336/Arbitrary.File.Read.via.Playwright.s.Screenshot.Feature.Exploiting.File.Wrapper.pdf

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@jmondi/url-to-png
Introduced in: 0Fixed in: 2.0.3
Fixnpm install @jmondi/url-to-png@2.0.3

References