cve/2024/CVE-2024-39919.md

### [CVE-2024-39919](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39919)
![](https://img.shields.io/static/v1?label=Product&message=url-to-png&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%202.1.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brighgreen)

### Description

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an `ALLOW_LIST` where the host can specify which services the user is permitted to capture screenshots of. By default, capturing screenshots of web services running on localhost, 127.0.0.1, or the [::] is allowed. If someone hosts this project on a server, users could then capture screenshots of other web services running locally. This issue has been addressed in version 2.1.1 with the addition of a blocklist. Users are advised to upgrade. There are no known workarounds for this vulnerability.

### POC

#### Reference
- https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-342q-2mc2-5gmp

#### Github
No PoCs found on GitHub currently.