MediumGHSA-c2gp-86p4-5935CVE-2019-5786
Use-After-Free in puppeteer
Published 2 Sept 2020 · Updated 8 Nov 2023
Affected package
puppeteernpm
- Affected
- <1.13.0
- Fixed in
- 1.13.0
Update to the fixed version for your release line, for example:
npm install puppeteer@1.13.0Details
Versions of puppeteer prior to 1.13.0 are vulnerable to the Use-After-Free vulnerability in Chromium (CVE-2019-5786). The Chromium FileReader API is vulnerable to Use-After-Free which may lead to Remote Code Execution.
Recommendation
Upgrade to version 1.13.0 or later.
Is GHSA-c2gp-86p4-5935 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected puppeteer, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2019-5786
- Linkgithub.com/GoogleChrome/puppeteer/issues/4141
- Linkblog.exodusintel.com/2019/03/20/cve-2019-5786-analysis-and-exploitation
- Linkchromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html
- Linkcrbug.com/936448
- Packagegithub.com/GoogleChrome/puppeteer
- Linksnyk.io/vuln/SNYK-JS-PUPPETEER-174321
- Linkwww.npmjs.com/advisories/824
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.