Description
Versions of puppeteer prior to 1.13.0 are vulnerable to the Use-After-Free vulnerability in Chromium (CVE-2019-5786). The Chromium FileReader API is vulnerable to Use-After-Free which may lead to Remote Code Execution.
Recommendation
Update the puppeteer package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.13.0
- Patched version(s): 1.13.0
References
- GHSA-c2gp-86p4-5935
- blog.exodusintel.com
- chromereleases.googleblog.com
- crbug.com
- snyk.io
- www.npmjs.com
- CVE-2019-5786
- CWE-416
- CAPEC-310
- OWASP 2021-A6
Related Issues
- @fastly/js-compute has a use-after-free in some host call implementations - CVE-2024-38375
- Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges - CVE-2026-50131
- Cross-site Scripting in node-red-dashboard - CVE-2019-10756
- angular Prototype Pollution vulnerability - CVE-2019-10768
You might also like:
- Tags:
- npm
- puppeteer
Anything's wrong? Let us know Last updated on November 11, 2023