Quick answers
- Is CVE-2026-85242 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-85242 being exploited in the wild.
- How severe is CVE-2026-85242?
- Informational severity, published 3 September 2026.
- Which products and versions are affected?
- Lookyloo PlaywrightCapture <b912a04.
- Is there a fix for CVE-2026-85242?
- A patch was published on 2026-09-03: Fix applied in commit b912a04f7b190807b5e14e497048896bc5016fb9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-85242 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-85242?
- Check whether you run Lookyloo PlaywrightCapture at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
PlaywrightCapture implements local-address validation for favicon URLs when only_global_lookup is enabled, blocking requests to localhost, loopback addresses, and internal IP ranges. However, the validation was not applied to HTTP redirects followed by the aiohttp library, allowing an attacker to specify a publicly reachable favicon URL that redirects to a restricted address, bypassing the filter. The vulnerability requires the attacker to influence page content processed by PlaywrightCapture and depends on internal services being accessible from the host. The patch introduces aiohttp middleware that validates every request in the redirect chain before it is issued, preventing requests to local or restricted destinations.
Affected products
- Lookyloo PlaywrightCapture <b912a04
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fix applied in commit b912a04f7b190807b5e14e497048896bc5016fb9