{"id":"CVE-2025-59288","aliases":["EUVD-2025-34363","GHSA-7mvr-c777-76hp","ROOT-APP-NPM-CVE-2025-59288"],"status":"published","title":"Playwright Spoofing Vulnerability","description":"Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00234,"percentile":0.14442,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2025-10-14T17:00:49Z","modified":"2026-10-24T10:30:32Z","fixes":[{"ecosystem":"npm","package":"playwright","fixed_in":["1.55.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"playwright","fixed_in":["1.49.0-aikido.2","1.44.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"playwright-core","fixed_in":["1.49.0-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/playwright-core","fixed_in":["1.49.0-root.io.1","1.49.0-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/playwright","fixed_in":["1.49.0-root.io.1","1.49.0-root.io.2","1.44.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"playwright","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.55.1"}]}]},{"source":"osv","ecosystem":"npm","package":"playwright","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.55.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"playwright","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.49.0-aikido.2"},{"fixed":"1.44.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"playwright-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.49.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/playwright-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.49.0-root.io.1"},{"fixed":"1.49.0-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/playwright","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.49.0-root.io.1"},{"fixed":"1.49.0-root.io.2"},{"fixed":"1.44.0-root.io.1"}]}]}],"products":[{"vendor":"microsoft","product":"microsoft/playwright"},{"vendor":"microsoft","product":"playwright"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59288","tags":["vendor-advisory","patch","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59288","tags":["advisory"]},{"url":"https://github.com/SocketDev/security-research/security/advisories/GHSA-qxm8-4v54-964r","tags":["web"]},{"url":"https://github.com/microsoft/playwright/pull/37532","tags":["web"]},{"url":"https://github.com/microsoft/playwright/commit/72c62d840247d9defd87c6beb0344d456794b570","tags":["web"]},{"url":"https://github.com/microsoft/playwright/releases/tag/v1.55.1","tags":["web"]},{"url":"https://github.com/microsoft/playwright/releases/tag/v1.56.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7mvr-c777-76hp"},{"url":"https://github.com/microsoft/playwright","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-59288","title":"Playwright Spoofing Vulnerability","description":"Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.","status":"published","published":"2025-10-14T17:00:49.154Z","modified":"2026-02-22T17:24:58.049Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:32:47.812946Z"}],"euvd":[{"id":"EUVD-2025-34363","description":"Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.","status":"published","published":"2025-10-14T17:00:49Z","modified":"2026-02-22T17:24:58Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RC:C","level":"medium"}],"updated_at":"2026-11-02T19:48:36.125178Z"}],"ghsa":[{"id":"GHSA-7mvr-c777-76hp","title":"Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate","description":"### Summary\nUse of `curl` with the `-k` (or `--insecure`) flag in installer scripts allows attackers to deliver arbitrary executables via Man-in-the-Middle (MitM) attacks. This can lead to full system compromise, as the downloaded files are installed as privileged applications.\n\n### Details\nThe following scripts in the `microsoft/playwright` repository at commit [`bee11cbc28f24bd18e726163d0b9b1571b4f26a8`](https://github.com/microsoft/playwright/commit/bee11cbc28f24bd18e726163d0b9b1571b4f26a8) use `curl -k` to fetch and install executable packages without verifying the authenticity of the SSL certificate:\n\n\n- [`packages/playwright-core/bin/reinstall_chrome_beta_mac.sh`](https://github.com/microsoft/playwright/blob/bee11cbc28f24bd18e726163d0b9b1571b4f26a8/packages/playwright-core/bin/reinstall_chrome_beta_mac.sh)\n- [`packages/playwright-core/bin/reinstall_chrome_stable_mac.sh`](https://github.com/microsoft/playwright/blob/bee11cbc28f24bd18e726163d0b9b1571b4f26a8/packages/playwright-core/bin/reinstall_chrome_stable_mac.sh)\n- [`packages/playwright-core/bin/reinstall_msedge_dev_mac.sh`](https://github.com/microsoft/playwright/blob/bee11cbc28f24bd18e726163d0b9b1571b4f26a8/packages/playwright-core/bin/reinstall_msedge_dev_mac.sh)\n- [`packages/playwright-core/bin/reinstall_msedge_beta_mac.sh`](https://github.com/microsoft/playwright/blob/bee11cbc28f24bd18e726163d0b9b1571b4f26a8/packages/playwright-core/bin/reinstall_msedge_beta_mac.sh)\n- [`packages/playwright-core/bin/reinstall_msedge_stable_mac.sh`](https://github.com/microsoft/playwright/blob/bee11cbc28f24bd18e726163d0b9b1571b4f26a8/packages/playwright-core/bin/reinstall_msedge_stable_mac.sh)\n\nIn each case, the shell scripts download a browser installer package using `curl -k` and immediately install it:\n\n```shell\ncurl --retry 3 -o ./\u003cpkg-file\u003e -k \u003curl\u003e\nsudo installer -pkg /tmp/\u003cpkg-file\u003e -target /\n```\n\nDisabling SSL verification (`-k`) means the download can be intercepted and replaced with malicious content.\n\n### PoC\nA high-level exploitation scenario:\n\n1. An attacker performs a MitM attack on a network where the victim runs one of these scripts.\n2. The attacker intercepts the HTTPS request and serves a malicious package (for example, a trojaned browser installer).\n3. Because `curl -k` is used, the script downloads and installs the attacker's payload without any certificate validation.\n4. The attacker's code is executed with system privileges, leading to full compromise.\n\nNo special configuration is needed: simply running these scripts on any untrusted or hostile network is enough.\n\n### Impact\nThis is a critical Remote Code Execution (RCE) vulnerability due to improper SSL certificate validation (CWE-295: Improper Certificate Validation). Any user or automation running these scripts is at risk of arbitrary code execution as root/admin, system compromise, data theft, or persistent malware installation. The risk is especially severe because browser packages are installed with elevated privileges and the scripts may be used in CI/CD or developer environments.\n\n### Fix\n\n - https://github.com/microsoft/playwright/commit/72c62d840247d9defd87c6beb0344d456794b570\n - https://github.com/microsoft/playwright/pull/37532\n - https://github.com/microsoft/playwright/releases/tag/v1.56.0\n\n### Credit\n\n- This vulnerability was uncovered by tooling by [Socket](https://socket.dev/)\n- This vulnerability was confirmed by @evilpacket\n- This vulnerability was reported by @JLLeitschuh at Socket\n\n### Disclosure\n - September 10th, 2025 - Disclosed to Microsoft privately via https://github.com/microsoft/playwright/security/advisories/GHSA-gx27-2j22-qcx8\n - September 11th, 2025 - Reported to Microsoft via MSRC Researcher Portal - https://msrc.microsoft.com/report/vulnerability/VULN-162854\n - September 11th, 2025 - Microsoft closed report as \"Complete - N/A\"\n - September 18th, 2025 - Following a [LinkedIn Post](https://www.linkedin.com/posts/jonathan-leitschuh_its-a-sad-state-of-the-world-when-i-acknowledge-activity-7374601182117511168--wnI?utm_source=social_share_send\u0026utm_medium=member_desktop_web\u0026rcm=ACoAAA0SLMUBScBUspIv0-LQ1ecAwsqt5l81eG4)","status":"published","published":"2025-10-14T18:30:36Z","modified":"2025-10-24T20:05:50Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:39:03.380616Z"}],"nvd":[{"id":"CVE-2025-59288","description":"Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.","status":"published","published":"2025-10-14T17:16:11.837Z","modified":"2026-10-08T12:10:00.217Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:11:38.17237Z"}],"osv":[{"id":"CVE-2025-59288","description":"Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.","status":"published","published":"2025-10-14T17:16:11.837Z","modified":"2026-10-24T10:30:32.257191367Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:51.190588Z"},{"id":"GHSA-7mvr-c777-76hp","title":"Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate","description":"### Summary\nUse of `curl` with the `-k` (or `--insecure`) flag in installer scripts allows attackers to deliver arbitrary executables via Man-in-the-Middle (MitM) attacks. This can lead to full system compromise, as the downloaded files are installed as privileged applications.\n\n### Details\nThe following scripts in the `microsoft/playwright` repository at commit [`bee11cbc28f24bd18e726163d0b9b1571b4f26a8`](https://github.com/microsoft/playwright/commit/bee11cbc28f24bd18e726163d0b9b1571b4f26a8) use `curl -k` to fetch and install executable packages without verifying the authenticity of the SSL certificate:\n\n\n- [`packages/playwright-core/bin/reinstall_chrome_beta_mac.sh`](https://github.com/microsoft/playwright/blob/bee11cbc28f24bd18e726163d0b9b1571b4f26a8/packages/playwright-core/bin/reinstall_chrome_beta_mac.sh)\n- [`packages/playwright-core/bin/reinstall_chrome_stable_mac.sh`](https://github.com/microsoft/playwright/blob/bee11cbc28f24bd18e726163d0b9b1571b4f26a8/packages/playwright-core/bin/reinstall_chrome_stable_mac.sh)\n- [`packages/playwright-core/bin/reinstall_msedge_dev_mac.sh`](https://github.com/microsoft/playwright/blob/bee11cbc28f24bd18e726163d0b9b1571b4f26a8/packages/playwright-core/bin/reinstall_msedge_dev_mac.sh)\n- [`packages/playwright-core/bin/reinstall_msedge_beta_mac.sh`](https://github.com/microsoft/playwright/blob/bee11cbc28f24bd18e726163d0b9b1571b4f26a8/packages/playwright-core/bin/reinstall_msedge_beta_mac.sh)\n- [`packages/playwright-core/bin/reinstall_msedge_stable_mac.sh`](https://github.com/microsoft/playwright/blob/bee11cbc28f24bd18e726163d0b9b1571b4f26a8/packages/playwright-core/bin/reinstall_msedge_stable_mac.sh)\n\nIn each case, the shell scripts download a browser installer package using `curl -k` and immediately install it:\n\n```shell\ncurl --retry 3 -o ./\u003cpkg-file\u003e -k \u003curl\u003e\nsudo installer -pkg /tmp/\u003cpkg-file\u003e -target /\n```\n\nDisabling SSL verification (`-k`) means the download can be intercepted and replaced with malicious content.\n\n### PoC\nA high-level exploitation scenario:\n\n1. An attacker performs a MitM attack on a network where the victim runs one of these scripts.\n2. The attacker intercepts the HTTPS request and serves a malicious package (for example, a trojaned browser installer).\n3. Because `curl -k` is used, the script downloads and installs the attacker's payload without any certificate validation.\n4. The attacker's code is executed with system privileges, leading to full compromise.\n\nNo special configuration is needed: simply running these scripts on any untrusted or hostile network is enough.\n\n### Impact\nThis is a critical Remote Code Execution (RCE) vulnerability due to improper SSL certificate validation (CWE-295: Improper Certificate Validation). Any user or automation running these scripts is at risk of arbitrary code execution as root/admin, system compromise, data theft, or persistent malware installation. The risk is especially severe because browser packages are installed with elevated privileges and the scripts may be used in CI/CD or developer environments.\n\n### Fix\n\n - https://github.com/microsoft/playwright/commit/72c62d840247d9defd87c6beb0344d456794b570\n - https://github.com/microsoft/playwright/pull/37532\n - https://github.com/microsoft/playwright/releases/tag/v1.56.0\n\n### Credit\n\n- This vulnerability was uncovered by tooling by [Socket](https://socket.dev/)\n- This vulnerability was confirmed by @evilpacket\n- This vulnerability was reported by @JLLeitschuh at Socket\n\n### Disclosure\n - September 10th, 2025 - Disclosed to Microsoft privately via https://github.com/microsoft/playwright/security/advisories/GHSA-gx27-2j22-qcx8\n - September 11th, 2025 - Reported to Microsoft via MSRC Researcher Portal - https://msrc.microsoft.com/report/vulnerability/VULN-162854\n - September 11th, 2025 - Microsoft closed report as \"Complete - N/A\"\n - September 18th, 2025 - Following a [LinkedIn Post](https://www.linkedin.com/posts/jonathan-leitschuh_its-a-sad-state-of-the-world-when-i-acknowledge-activity-7374601182117511168--wnI?utm_source=social_share_send\u0026utm_medium=member_desktop_web\u0026rcm=ACoAAA0SLMUBScBUspIv0-LQ1ecAwsqt5l81eG4)","status":"published","published":"2025-10-14T18:30:36Z","modified":"2026-09-10T03:50:29.418266842Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"ROOT-APP-NPM-CVE-2025-59288","title":"CVE-2025-59288 in playwright - Patched by Root","description":"Root has patched CVE-2025-59288 in the playwright package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-11T08:46:41Z","modified":"2026-09-11T09:15:03.260812311Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.362922Z"}]}}