TI-2020-07150 Aliases CVE-2020-8902 GHSA-xr9h-9m79-x29g

SSRF in Rendertron

LOW 20CWE-284Published 2021-02-23 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass, Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284, CWE-918 and the CVSS impact.

Summary

Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a screenshot. Suggested mitigations are to upgrade your rendertron to version 3.0.0, or, if you cannot update, to secure the infrastructure to limit the headless chrome's access to your internal domain.

Why it matters now

EPSS 0.00325 25th percentileScored 2026-11-07

Fix Fixed Rendertron (Google LLC): 3.0.0rendertron (npm): 3.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Google	Rendertron	stable to before 3.0.0	3.0.0	Patch available	CNA
—	rendertron (npm)	before 3.0.0	3.0.0	Patch available	GHSA-xr9h-9m79-x29g

Rendertron VendorGoogle Affected stable to before 3.0.0 Fixed in 3.0.0 Patch available CNA
rendertron (npm) Vendor— Affected before 3.0.0 Fixed in 3.0.0 Patch available GHSA-xr9h-9m79-x29g

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:google:rendertron::::::::	before 3.0.0	Vulnerable	Google

cpe:2.3:a:google:rendertron:*:*:*:*:*:*:*:* Versions before 3.0.0 Vulnerable ·Google

Remediation

Fix · CNA Rendertron (Google LLC) Fixed in 3.0.0
Fix · GHSA-xr9h-9m79-x29g rendertron (npm) Fixed in 3.0.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-8902
2026-10-03 Alias added: GHSA-xr9h-9m79-x29g

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2020-8902

Other 2

TI-2017-13529 Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote… CVSS 3.0HIGH 7.5
TI-2017-13528 Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local… CVSS 3.0HIGH 7.5
TI-2017-13527 Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible… CVSS 3.0HIGH 7.5
TI-2017-13526 Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs. CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences