-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation of URLs. The commit 92cf16f explicitly patched this by adding a check in the setUrl method to block 'file://' URLs. Before this patch, setUrl allowed attackers to set URLs starting with 'file://', which could reference local files. The CVE description highlights that external JS content with 'file://' URLs could be passed via Browsershot::html, but the root cause was the lack of validation in URL handling. The setUrl method's missing validation was the primary entry point for this exploit, as confirmed by the patch's focus on this method.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| spatie/browsershot | composer | < 3.57.4 | 3.57.4 |