CVE-2024-39918

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the `ImageId` in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in an arbitrary location that the server has permission to access. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-22

• https://github.com/jasonraimondi/url-to-png/blob/e43098e0af3a380ebc044e7f303a83933b94b434/src/middlewares/extract_query_params.ts#L75
• https://github.com/jasonraimondi/url-to-png/commit/e4eaeca6493b21cd515b582fd6c0af09ede54507
• https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-vvmv-wrvp-9gjr
• https://github.com/jasonraimondi/url-to-png/blob/e43098e0af3a380ebc044e7f303a83933b94b434/src/middlewares/extract_query_params.ts#L75
• https://github.com/jasonraimondi/url-to-png/commit/e4eaeca6493b21cd515b582fd6c0af09ede54507
• https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-vvmv-wrvp-9gjr

Published

Jul 15, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-399111Panel is a web-based linux server management control panel.…9.8
• CVE-2024-39912web-auth/webauthn-lib is an open source set of PHP libraries…5.3
• CVE-2024-39914FOG is a cloning/imaging/rescue suite/inventory management s…9.8
• CVE-2024-39915Thruk is a multibackend monitoring webinterface for Naemon, …9.9
• CVE-2024-39916FOG is a free open-source cloning/imaging/rescue suite/inven…6.4
• CVE-2024-39917xrdp is an open source RDP server. xrdp versions prior to 0.…9.8
• CVE-2024-39919@jmondi/url-to-png is an open source URL to PNG utility feat…3.1
• CVE-2024-3992The Amen WordPress plugin through 3.3.1 does not sanitise an…4.8
• CVE-2024-39920The TCP protocol in RFC 9293 has a timing side channel that …4.3
• CVE-2024-39921Observable timing discrepancy issue exists in IPCOM EX2 Seri…7.5
• CVE-2024-39922A vulnerability has been identified in LOGO! 12/24RCE (6ED10…5.1
• CVE-2024-39923An issue was discovered in Mahara 24.04 before 24.04.2 and 2…6.1