Packages / playwright / Security

HighVulnerabilityGHSA-7mvr-c777-76hpCVE-2025-59288Published 14 Oct 2025

Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate

Affected · playwright

  • < 1.55.1

Fixed in

1.55.1

npm install playwright@1.55.1

  1. Affected

    0.0.0 – 1.55.0

    174 releases

  2. Fixed

    1.55.1 – 1.64.1

    17 releases, latest

191 stable releases of playwright, oldest to newest.

What happens

Summary

Use of curl with the -k (or --insecure) flag in installer scripts allows attackers to deliver arbitrary executables via Man-in-the-Middle (MitM) attacks. This can lead to full system compromise, as the downloaded files are installed as privileged applications.

Details

The following scripts in the microsoft/playwright repository at commit bee11cbc28f24bd18e726163d0b9b1571b4f26a8 use curl -k to fetch and install executable packages without verifying the authenticity of the SSL certificate:

In each case, the shell scripts download a browser installer package using curl -k and immediately install it:

curl --retry 3 -o ./<pkg-file> -k <url>
sudo installer -pkg /tmp/<pkg-file> -target /

Disabling SSL verification (-k) means the download can be intercepted and replaced with malicious content.

PoC

A high-level exploitation scenario:

  1. An attacker performs a MitM attack on a network where the victim runs one of these scripts.

  2. The attacker intercepts the HTTPS request and serves a malicious package (for example, a trojaned browser installer).

  3. Because curl -k is used, the script downloads and installs the attacker's payload without any certificate validation.

  4. The attacker's code is executed with system privileges, leading to full compromise.

No special configuration is needed: simply running these scripts on any untrusted or hostile network is enough.

Impact

This is a critical Remote Code Execution (RCE) vulnerability due to improper SSL certificate validation (CWE-295: Improper Certificate Validation). Any user or automation running these scripts is at risk of arbitrary code execution as root/admin, system compromise, data theft, or persistent malware installation. The risk is especially severe because browser packages are installed with elevated privileges and the scripts may be used in CI/CD or developer environments.

Fix

Credit

  • This vulnerability was uncovered by tooling by Socket

  • This vulnerability was confirmed by @evilpacket

  • This vulnerability was reported by @JLLeitschuh at Socket

Disclosure