CVE-2026-63175

Executive Summary

CVE-2026-63175 is a high-severity (CVSS 7.1) information disclosure and state-confusion vulnerability in CIRCL's Looklyloo – PlaywrightCapture component, affecting Python deployments where multiple Capture objects run within a single process. Due to mutable class-level variables holding capture-specific configuration and runtime data, concurrent or sequential captures share state — including HTTP headers, cookies, browser storage, credentials, proxy settings, and captured request data. In multi-user or multi-tenant deployments, this allows one user's authentication context to leak into another user's capture session, potentially exposing credentials, cookies, and sensitive request data, or enabling cross-tenant request manipulation. The fix involves moving all per-capture state into instance variables within the Capture constructor.

Technical Analysis

The vulnerability stems from a fundamental Python scoping error: mutable class-level attributes are used to store per-capture configuration and runtime data. In Python, class attributes are shared across all instances of that class unless explicitly overridden in __init__. The following pseudo-code illustrates the flaw:

class Capture:
    # Class-level mutable state — WRONG
    headers = {}
    cookies = {}
    proxy_config = None
    request_data = []

    def __init__(self, target):
        self.target = target  # instance-level, but shared state remains class-level

When code sets Capture.headers['Authorization'] = 'Bearer <token>', it mutates the class attribute. Any subsequent Capture object created in the same process sees that same token. The same applies to:

• HTTP headers (including Authorization, Cookie, X-API-Key)
• Cookie jars and browser storage
• HTTP credentials (Basic/Digest auth)
• Proxy configuration (an attacker-influenced capture could route traffic through a malicious proxy)
• User-agent strings and geolocation overrides
• Captured request/response data buffers

Attack surface: This is exploitable in any multi-tenant or multi-user environment where an application instantiates Capture objects for different users without isolating processes. Common scenarios include:

• A SaaS platform where users submit URLs for screenshotting or scraping.
• A CI/CD pipeline that captures pages using stored credentials for different accounts.
• An internal tool where users create captures against internal services.

Because the flaw is in-state handling, it can be triggered without any network-level attack — a legitimate capture request is sufficient. The severity is amplified by the scope change in the CVSS vector (S:C), meaning the impact crosses authorization boundaries.

Root cause: The developer likely used class variables to avoid repeating configuration defaults, not realizing they are shared. The fix (moving to __init__) correctly scopes state per instance.

Exploitation Scenarios

Scenario: Multi-Tenant Screenshot Service

1. Reconnaissance: The attacker registers for a legitimate account on a public web-screenshotting service built on PlaywrightCapture. They identify the API endpoint (e.g., POST /api/capture with {"url": "..."}). They create two captures to understand the request flow.

2. Trigger/Weaponization: Because state is class-level, the attacker crafts two concurrent capture requests:

   • Request A – a benign URL (https://example.com) with the victim's context: the attacker modifies the JSON body to include a custom headers field (e.g., {"Authorization": "Bearer victim-token"}). PlaywrightCapture stores this in the shared class-level headers dict.
   • Request B – a URL under the attacker's control (https://attacker.com/log), sent immediately after Request A, without any custom headers.

3. Payload/Execution: Due to shared class-level state, Request B's Capture object reads the headers class variable, which still contains Authorization: Bearer victim-token from Request A. The attacker's server receives the victim's token in the incoming HTTP request headers.

4. Post-Exploitation: The attacker now has the victim's Bearer token. They use it to access victim-only API endpoints. In a deeper attack, if the shared state includes proxy configuration, the attacker could inject their proxy address into the class variable, causing all subsequent victims' captures to route through the attacker's proxy, capturing plaintext credentials.

Alternative chain with sequential captures: The attacker sends a capture for a URL requiring HTTP basic auth. The system stores credentials in the class-level credentials var. The victim's next capture (e.g., an internal dashboard URL) silently uses the attacker's credentials — either failing (revealing the attacker's lack of access) or, worse, the attacker's credentials have broader rights, granting the victim unintended access that is then logged.

Impact Assessment

CVSS 7.1 (High) — Vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N:

• Confidentiality Impact: High — The core issue: authentication cookies, credentials, browser storage, and captured request data from one user are disclosed to another. This directly maps to the CVSS C:H.
• Integrity Impact: Low — An attacker can influence the context in which a victim's capture executes (e.g., forcing the use of the attacker's proxy or headers), but cannot directly modify stored data.
• Availability Impact: None — No denial-of-service vector identified.
• Scope: Changed — The vulnerable component violates the security boundary of the hosting application, allowing impact on resources beyond the compromised session.

Business Impact:

• Credential exposure leading to account takeover on downstream services.
• Cross-tenant data leakage in multi-tenant SaaS deployments — the highest-risk scenario, potentially triggering regulatory notification (GDPR, CCPA).
• Request hijacking — if proxy state is shared, an attacker can exfiltrate victim traffic.
• Compliance — SOX, PCI-DSS, or HIPAA environments that process sensitive data through this component face elevated audit findings.

Affected Systems: All Python services using playwright-capture with the mutable class-level pattern and running more than one Capture object per process. Single-tenant, single-threaded deployments with one capture at a time are at lower risk but not immune (sequential state bleed).

Blast Radius: Any system that programmatically accesses authenticated resources (internal tools, monitoring agents, scraping services) where the captured session's identity is distinct per operation. The EPSS score of 0.00295 (21.7th percentile) suggests low active exploitation, but the attack surface is trivial to trigger once discovered.

Detection Guidance

Sigma Rule

title: PlaywrightCapture Class-Level State Leakage - Concurrent Capture Activity
id: 7f3d9e2a-1c8b-4e5f-9a0d-3b6c8e1f2a4d
status: experimental
description: Detects multiple concurrent PlaywrightCapture requests that may indicate exploitation of CVE-2026-63175 shared mutable state
logsource:
    category: application
    product: python
detection:
    selection:
        EventID: 'capture_created'
        Component: ['playwright_capture', 'looklyloo']
    timeframe: 10s
    condition: selection | count() by src_user > 5
level: medium
tags:
    - attack.t1213
    - cve.2026.63175
falsepositives:
    - Legitimate high-volume automation running many captures in parallel

YARA Rule

rule CVE_2026_63175_PlaywrightCapture_StateLeak
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects source code pattern of class-level mutable state in PlaywrightCapture Capture class"
        cve = "CVE-2026-63175"
        date = "2026-08-15"
    strings:
        $class_def = "class Capture:"
        $class_var_headers = "headers = {}" ascii wide
        $class_var_cookies = "cookies = {}" ascii wide
        $class_var_proxy = "proxy" ascii wide
        $class_var_creds = "credentials" ascii wide
        $init_missing = "def __init__" ascii wide
    condition:
        $class_def and 2 of ($class_var*) and not $init_missing
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET WEB_SERVER Suspicious Concurrent Capture Requests Targeting PlaywrightCapture"; flow:established,to_server; content:"POST"; http_method; content:"/capture"; http_uri; content:"url="; http_client_body; content:"headers"; http_client_body; content:"authorization"; http_client_body; threshold:type both, track by_src, count 5, seconds 10; reference:cve,2026-63175; classtype:attempted-user; sid:7000001; rev:1;)

Elastic Detection

sequence by source.user.name with maxspan=10s
  [any where process.name == "python" and event.action == "capture_start"]
  [any where process.name == "python" and event.action == "capture_start"]
  [any where process.name == "python" and event.action == "capture_start"]
  [any where process.name == "python" and event.action == "capture_start"]
  [any where process.name == "python" and event.action == "capture_start"]

Splunk SPL Query

index=main sourcetype=python_application Component=playwright_capture
| stats count by src_user _time
| eval window=case(_time - lag(_time) < 10, "burst")
| search window="burst" count > 5
| table _time src_user count Component
| sort - _time

Wazuh OSSEC Rule

<group name="cve-2026-63175,">
    <rule id="100631" level="12">
        <decoded_as>json</decoded_as>
        <field name="component">playwright_capture</field>
        <field name="event_type">^capture_created$</field>
        <description>CVE-2026-63175: Multiple concurrent PlaywrightCapture instances detected - possible shared state exploitation</description>
        <group>playwright_capture,cve_2026_63175,</group>
        <if_sid>100630</if_sid>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Rating: 2/4 (CLAIMED — single source claims patch, not independently confirmed)

1. Immediate Mitigations (before patch):

   • Isolate processes: Run each Capture operation in a separate Python process (e.g., using multiprocessing.Pool with maxtasksperchild=1) to prevent class-state sharing.
   • Disable multi-user access: If the component is behind an API, restrict to single-user service accounts until patched.
   • Audit class-level variables: Manually inspect the Capture class (and any subclasses) for headers, cookies, credentials, proxy, user_agent, geolocation, and storage variables declared at class scope. If found, explicitly reset them in __init__ as an interim hotfix.

2. Patch/Upgrade Steps:

   • The vendor (CIRCL, via OSV) claims a patch that initializes all capture-specific settings and request data as instance variables in the Capture constructor.
   • Update to the patched version via the relevant Python package manager when the fixed version tag is available:

     pip install --upgrade playwright-capture   # Python
     conda update playwright-capture            # Conda
     poetry update playwright-capture           # Poetry
     

   • Caution: Patch is not independently verified. Deploy in a staging environment first and verify with a test that creates two captures with different headers, confirming isolation.

3. Long-Term Hardening:

   • Code review check: Enforce a rule that all mutable state in Python classes must be instance-level (self.) unless explicitly documented as shared global state.
   • Add static analysis: Integrate a tool like bandit or semgrep with a custom rule to flag class-level mutable defaults (= {}, = [], = set()).
   • Runtime isolation: For multi-tenant environments, design the deployment so each tenant's capture operations run in a dedicated worker process or container with no shared memory space.
   • Secret rotation: Assume potential exposure — rotate any credentials, cookies, or tokens that may have flowed through this component during the vulnerable window.
   • Monitor for cross-tenant anomalies: Track captures that reference resources (URLs, headers) outside the authenticated user's typical pattern.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-63175
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-63175 (patch source — single-claim, unverified)
3. CIRCL Official Site: https://www.circl.lu (vendor homepage; advisory page not yet public)
4. MITRE ATT&CK Technique – T1213: https://attack.mitre.org/techniques/T1213/
5. CWE-708 – Improper Use of Reference Counters (closest classification): https://cwe.mitre.org/data/definitions/708.html

Known Threat Actor Campaigns: None reported. This CVE is not in the CISA KEV catalog. No exploit code, Metasploit module, or Nuclei template is publicly available. The EPSS score (0.00295; 21.7th percentile) indicates a lower likelihood of active exploitation relative to other CVEs.