Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

playwright

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7npmAmendedPublished

    Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate

    CVE-2025-59288 · GHSA-7mvr-c777-76hp

    Affected
    • npm playwright < 1.55.1
    Fixed in
    1.55.1· Vendor fix available
    Issue
    Use of curl with the -k (or --insecure) flag in installer scripts allows attackers to deliver arbitrary executables via Man-in-the-Middle (MitM) attacks. This can lead to full system compromise, as the downloaded files are installed as privileged applications. Details The following scripts in the microsoft/playwright repository at commit bee11cbc28f24bd18e726163d0b9b1571b4f26a8 use curl -k to fetch and install executable packages without verifying the authenticity of the SSL certificate: - packages/playwright-core/bin/reinstallchromebetamac.sh - packages/playwright-core/bin/reinstallchromestablemac.sh - packages/playwright-core/bin/reinstallmsedgedevmac.sh - packages/playwright-core/bin/reinstallmsedgebetamac.sh - packages/playwright-core/bin/reinstallmsedgestablemac.sh In each case, the shell scripts download a browser installer package using curl -k and immediately install it: Disabling SSL verification (-k) means the download can be intercepted and replaced with malicious…

    Recommended action: Upgrade to 1.55.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →