Skip to content
OpenAdvisories

Vendor

jasonraimondi

3 known vulnerabilities.

Products

url-to-png 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2024-39918

    Path Traveral in @jmondi/url-to-png

    @jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the `ImageId` in the code is not sanitized and may lead to path traversal. This …

    jasonraimondi url-to-png @jmondi/url-to-png npm
  • Medium 5.3
    CVE-2024-37169

    @jmondi/url-to-png arbitrary file read via Playwright's screenshot feature exploiting file wrapper

    @jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input …

    jasonraimondi url-to-png @jmondi/url-to-png npm