Packages / puppeteer / Security

ModerateVulnerabilityGHSA-c2gp-86p4-5935CVE-2019-5786Published 2 Sep 2020

Use-After-Free in puppeteer

Your version

Affected releases · puppeteer

  • 1.x1.0.0 – 1.12.2Fixed in 1.13.0
  • 0.13.x and older0.0.0 – 0.13.0No fix, no longer updated

On 1.x, the newest line:

npm install puppeteer@1.13.0
Every release on a timeline
25.x

  1. Not affected

    25.0.0 – 25.16.0

    22 releases, latest

1.x

  1. Affected

    1.0.0 – 1.12.2

    18 releases

  2. Fixed

    1.13.0 – 1.20.0

    9 releases

0.x

  1. Affected

    0.0.0 – 0.13.0

    8 releases

374 stable releases of puppeteer, oldest to newest, one row per major.

What happens

Versions of puppeteer prior to 1.13.0 are vulnerable to the Use-After-Free vulnerability in Chromium (CVE-2019-5786). The Chromium FileReader API is vulnerable to Use-After-Free which may lead to Remote Code Execution.

Recommendation

Upgrade to version 1.13.0 or later.