AIKIDO-2026-10209
spatie/browsershot is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
47
Medium Risk
This Affects:
spatie/browsershotTL;DR
Affected versions of this package are vulnerable to local file read. Insufficient validation of URLs in HTML content allows attackers to bypass protections using UNC paths or protocol-relative URLs pointing to local addresses (for example \\localhost or //127.0.0.1). This can allow unauthorized access to local files when rendering content.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
spatie/browsershot is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 2.0.0 - 5.2.0.
How to fix this
Upgrade the spatie/browsershot library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.