CVE-2024-37169: Jasonraimondi Url-To-Png

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol `http` or `https`. No known workarounds are available aside from upgrading.

Affected products

• Jasonraimondi Url-To-Png: before 2.0.3 (fixed in 2.0.3)

Published 2024-06-10. Last modified 2026-06-17.