AIKIDO-2026-462988
playwrightcapture is vulnerable to Information Disclosure
71
High Risk
This Affects:
playwrightcaptureTL;DR
PlaywrightCapture stores capture-specific configuration and runtime data in mutable class-level variables instead of per-instance variables. When multiple Capture objects run inside the same Python process they share state such as cookies, HTTP headers, credentials, browser storage, proxy configuration, and captured request data. A capture can therefore inherit or expose another capture's session data, disclosing sensitive information or issuing requests under another capture's authentication context. The fix initializes all capture-specific settings and request data as instance variables in the Capture constructor so state is isolated between capture operations.
Who does this affect?
You are affected if you use a version within the vulnerable range and run more than one capture inside the same Python process, especially when captures supply externally influenced or user-controlled cookies, headers, credentials, storage state, or proxy settings that can then bleed into a subsequent capture.
Background info
playwrightcapture is vulnerable to Information Disclosure in versions 1.39.0 - 1.40.2.
How to fix this
Upgrade the playwrightcapture library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant