GHSA-7mvr-c777-76hp

Suggest an improvement
Source
https://github.com/advisories/GHSA-7mvr-c777-76hp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-7mvr-c777-76hp/GHSA-7mvr-c777-76hp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-7mvr-c777-76hp
Aliases
  • CVE-2025-59288
Related
Published
2025-10-14T18:30:36Z
Modified
2025-10-24T20:05:47Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate
Details

Summary

Use of curl with the -k (or --insecure) flag in installer scripts allows attackers to deliver arbitrary executables via Man-in-the-Middle (MitM) attacks. This can lead to full system compromise, as the downloaded files are installed as privileged applications.

Details

The following scripts in the microsoft/playwright repository at commit <code>bee11cbc28f24bd18e726163d0b9b1571b4f26a8</code> use curl -k to fetch and install executable packages without verifying the authenticity of the SSL certificate:

In each case, the shell scripts download a browser installer package using curl -k and immediately install it:

curl --retry 3 -o ./<pkg-file> -k <url>
sudo installer -pkg /tmp/<pkg-file> -target /

Disabling SSL verification (-k) means the download can be intercepted and replaced with malicious content.

PoC

A high-level exploitation scenario:

  1. An attacker performs a MitM attack on a network where the victim runs one of these scripts.
  2. The attacker intercepts the HTTPS request and serves a malicious package (for example, a trojaned browser installer).
  3. Because curl -k is used, the script downloads and installs the attacker's payload without any certificate validation.
  4. The attacker's code is executed with system privileges, leading to full compromise.

No special configuration is needed: simply running these scripts on any untrusted or hostile network is enough.

Impact

This is a critical Remote Code Execution (RCE) vulnerability due to improper SSL certificate validation (CWE-295: Improper Certificate Validation). Any user or automation running these scripts is at risk of arbitrary code execution as root/admin, system compromise, data theft, or persistent malware installation. The risk is especially severe because browser packages are installed with elevated privileges and the scripts may be used in CI/CD or developer environments.

Fix

  • https://github.com/microsoft/playwright/commit/72c62d840247d9defd87c6beb0344d456794b570
  • https://github.com/microsoft/playwright/pull/37532
  • https://github.com/microsoft/playwright/releases/tag/v1.56.0

Credit

  • This vulnerability was uncovered by tooling by Socket
  • This vulnerability was confirmed by @evilpacket
  • This vulnerability was reported by @JLLeitschuh at Socket

Disclosure

  • September 10th, 2025 - Disclosed to Microsoft privately via https://github.com/microsoft/playwright/security/advisories/GHSA-gx27-2j22-qcx8
  • September 11th, 2025 - Reported to Microsoft via MSRC Researcher Portal - https://msrc.microsoft.com/report/vulnerability/VULN-162854
  • September 11th, 2025 - Microsoft closed report as "Complete - N/A"
  • September 18th, 2025 - Following a LinkedIn Post
Database specific 
{
    "cwe_ids": [
        "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-20T14:19:32Z",
    "severity": "HIGH",
    "nvd_published_at": "2025-10-14T17:16:11Z"
}
References

Affected packages

npm / playwright

Package

Name
playwright
View open source insights on deps.dev
Purl
pkg:npm/playwright

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.55.1