Quick answers
- Is CVE-2019-5786 exploited in the wild?
- Yes. CVE-2019-5786 is known to be exploited in the wild, first recorded on 23 May 2022. Treat it as urgent.
- How severe is CVE-2019-5786?
- Critical severity, with a CVSS score of 3, published 2 September 2020.
- Which products and versions are affected?
- puppeteer (npm) SEMVER:introduced=0,fixed=1.13.0.
- Is there a fix for CVE-2019-5786?
- Yes. puppeteer (npm): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2019-5786 attacked?
- It is attacked over the network.
- Am I affected by CVE-2019-5786?
- Check whether you run Google Chrome Blink or puppeteer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- puppeteer (npm): upgrade to 1.13.0 or later
npm install puppeteer@1.13.0
Technical details
This is a use-after-free vulnerability (CWE-416) in Chromium's FileReader API that affects Puppeteer versions before 1.13.0. The vulnerability stems from improper memory management in the underlying Chromium engine. An attacker can trigger the use-after-free condition through crafted web content that interacts with the FileReader API, potentially achieving remote code execution. The attack requires user interaction (opening or processing malicious content in Puppeteer) but the network vector is available if Puppeteer processes untrusted URLs. A fix is available by upgrading to Puppeteer 1.13.0 or later.
Affected products
- Google Puppeteer < 1.13.0
Identifiers
- CVE-2019-5786
- GHSA-c2gp-86p4-5935
Timeline
- 2020-09-02: disclosed
- 1.13.0: patched