Is CVE-2026-44439 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44439 being exploited in the wild.

How severe is CVE-2026-44439?

High severity, with a CVSS score of 7.5, published 13 May 2026.

Which products and versions are affected?

Lookyloo PlaywrightCapture < 1.39.6; playwrightcapture (PyPI) ECOSYSTEM:introduced=0,fixed=1.39.6.

Is there a fix for CVE-2026-44439?

Yes. playwrightcapture (PyPI): upgrade to 1.39.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44439 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44439?

Check whether you run Lookyloo Playwright Capture, Lookyloo PlaywrightCapture or playwrightcapture (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44439: Lookyloo PlaywrightCapture SSRF and local file access

Q: Is there a fix for CVE-2026-44439?

Yes. playwrightcapture (PyPI): upgrade to 1.39.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44439 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44439?

Check whether you run Lookyloo Playwright Capture, Lookyloo PlaywrightCapture or playwrightcapture (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44439 · Severity: high · CVSS 7.5 · Published 2026-05-13

PlaywrightCapture is a tool used to automate the process of capturing and rendering web pages. A security flaw allows an attacker to trick the tool into accessing private internal network resources or local files on the server instead of the intended public website. This could lead to the exposure of sensitive internal data, such as configuration files or private service responses, through the tool's screenshots and logs.

Technologies: Lookyloo PlaywrightCapture. Vendors: Lookyloo, PyPI.

Quick answers

Is CVE-2026-44439 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44439 being exploited in the wild.
How severe is CVE-2026-44439?: High severity, with a CVSS score of 7.5, published 13 May 2026.
Which products and versions are affected?: Lookyloo PlaywrightCapture < 1.39.6; playwrightcapture (PyPI) ECOSYSTEM:introduced=0,fixed=1.39.6.
Is there a fix for CVE-2026-44439?: Yes. playwrightcapture (PyPI): upgrade to 1.39.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44439 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44439?: Check whether you run Lookyloo Playwright Capture, Lookyloo PlaywrightCapture or playwrightcapture (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

playwrightcapture (PyPI): upgrade to 1.39.6 or later
```
pip install "playwrightcapture>=1.39.6"
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in PlaywrightCapture due to insufficient restriction of navigations and resource requests initiated by rendered pages. An attacker can provide a malicious URL that uses browser-side redirection (e.g., window.location.href) to force the capture process to access file:// URLs or non-public IP addresses (loopback, private, or link-local). This allows for the exfiltration of local files or internal service responses through capture artifacts like screenshots, saved page content, or logs. The issue is addressed in version 1.39.6 by implementing request routing checks that block secondary requests to non-global IP addresses and local domains when the only_global_lookup setting is enabled.

Affected products

Lookyloo PlaywrightCapture < 1.39.6

Identifiers

CVE-2026-44439
GHSA-687h-xw6f-q2qw
PYSEC-2026-2259

Timeline

2026-04-30: disclosed: Vulnerability reported to vendor
2026-05-06: advisory: GitHub Advisory published
2026-05-13: other: NVD published CVE-2026-44439

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.