CVE-2024-39919

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an `ALLOW_LIST` where the host can specify which services the user is permitted to capture screenshots of. By default, capturing screenshots of web services running on localhost, 127.0.0.1, or the [::] is allowed. If someone hosts this project on a server, users could then capture screenshots of other web services running locally. This issue has been addressed in version 2.1.1 with the addition of a blocklist. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-200

• https://github.com/jasonraimondi/url-to-png/commit/f62ff40403ffa1781459d6be8d97b8035888c00c
• https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-342q-2mc2-5gmp
• https://github.com/jasonraimondi/url-to-png/commit/f62ff40403ffa1781459d6be8d97b8035888c00c
• https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-342q-2mc2-5gmp

Published

Jul 15, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39912web-auth/webauthn-lib is an open source set of PHP libraries…5.3
• CVE-2024-39914FOG is a cloning/imaging/rescue suite/inventory management s…9.8
• CVE-2024-39915Thruk is a multibackend monitoring webinterface for Naemon, …9.9
• CVE-2024-39916FOG is a free open-source cloning/imaging/rescue suite/inven…6.4
• CVE-2024-39917xrdp is an open source RDP server. xrdp versions prior to 0.…9.8
• CVE-2024-39918@jmondi/url-to-png is an open source URL to PNG utility feat…4.3
• CVE-2024-3992The Amen WordPress plugin through 3.3.1 does not sanitise an…4.8
• CVE-2024-39920The TCP protocol in RFC 9293 has a timing side channel that …4.3
• CVE-2024-39921Observable timing discrepancy issue exists in IPCOM EX2 Seri…7.5
• CVE-2024-39922A vulnerability has been identified in LOGO! 12/24RCE (6ED10…5.1
• CVE-2024-39923An issue was discovered in Mahara 24.04 before 24.04.2 and 2…6.1
• CVE-2024-39924An issue was discovered in Vaultwarden (formerly Bitwarden_R…8.8