@jmondi/url-to-png arbitrary file read via Playwright's screenshot feature exploiting file wrapper
Priority LOW 31CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol `http` or `https`. No known workarounds are available aside from upgrading.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00529 44th percentileScored 2026-11-07
Fix Fixed url-to-png (jasonraimondi): 2.0.3@jmondi/url-to-png (npm): 2.0.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jasonraimondi | url-to-png | before 2.0.3 | 2.0.3 | Patch available | CNA |
| — | @jmondi/url-to-png (npm) | before 2.0.3 | 2.0.3 | Patch available | GHSA-665w-mwrr-77q3 |
- url-to-png Vendorjasonraimondi Affected before 2.0.3 Fixed in 2.0.3 Patch available CNA
- @jmondi/url-to-png (npm) Vendor— Affected before 2.0.3 Fixed in 2.0.3 Patch available GHSA-665w-mwrr-77q3
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jasonraimondi:url-to-png:*:*:*:*:*:*:*:* | — | — | jasonraimondi |
- cpe:2.3:a:jasonraimondi:url-to-png:*:*:*:*:*:*:*:* Versions — — ·jasonraimondi
Remediation
- Fix · CNA url-to-png (jasonraimondi) Fixed in 2.0.3
- Fix · GHSA-665w-mwrr-77q3 @jmondi/url-to-png (npm) Fixed in 2.0.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-37169
- 2026-10-03 Alias added: GHSA-665w-mwrr-77q3
References
Other 6
- https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-665w-mwrr-77q3
- https://github.com/jasonraimondi/url-to-png/issues/47
- https://github.com/jasonraimondi/url-to-png/commit/9336020c5e603323f5cf4a2ac3bb9a7735cf61f7
- https://github.com/jasonraimondi/url-to-png/releases/tag/v2.0.3
- https://github.com/user-attachments/files/15536336/Arbitrary.File.Read.via.Playwright.s.Screenshot.Feature.Exploiting.File.Wrapper.pdf
- https://github.com/jasonraimondi/url-to-png
More jasonraimondi vulnerabilities
- TI-2024-26811 Path Traveral in @jmondi/url-to-png CVSS 3.1MEDIUM 4.3
- TI-2024-26812 Capture screenshot of localhost web services (unauthenticated pages) in @jmondi/url-to-png CVSS 3.1LOW 3.1
Sources
- CVE-2024-37169 · CVE Program
- CVE-2024-37169 · NVD
- FIRST EPSS
- GHSA-665w-mwrr-77q3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences