CVE-2019-5786 – puppeteer

Package

Manager: npm
Name: puppeteer
Vulnerable Version: >=0 <1.13.0

Severity

Level: Medium

CVSS v3.1: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS: 0.89984 pctl0.9956

Details

Use-After-Free in puppeteer Versions of `puppeteer` prior to 1.13.0 are vulnerable to the Use-After-Free vulnerability in Chromium (CVE-2019-5786). The Chromium FileReader API is vulnerable to Use-After-Free which may lead to Remote Code Execution. ## Recommendation Upgrade to version 1.13.0 or later.

Metadata

Created: 2020-09-02T18:25:43Z
Modified: 2021-09-27T16:20:33Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-c2gp-86p4-5935/GHSA-c2gp-86p4-5935.json
CWE IDs: ["CWE-416"]
Alternative ID: GHSA-c2gp-86p4-5935
Finding: F138
Auto approve: 1