GitHub Advisoryadvisory · npm

GHSA-c2gp-86p4-5935 Use-After-Free in puppeteer

MEDIUM Published 2020-09-02 Modified 2021-09-27 Official page ↗
Aliases
CVE-2019-5786
Ecosystem
npm
Packages
puppeteer
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-416
Reviewed
2020-08-31

Affected packages

• npm puppeteer: < 1.13.0 → fixed in 1.13.0

Description

Versions of `puppeteer` prior to 1.13.0 are vulnerable to the Use-After-Free vulnerability in Chromium (CVE-2019-5786). The Chromium FileReader API is vulnerable to Use-After-Free which may lead to Remote Code Execution. Recommendation Upgrade to version 1.13.0 or later.

Related

Alias · CVE (1)

  • CVE-2019-5786 Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds… vulnerability

Weakness · CWE (1)

References