{
"id": "GHSA-c2gp-86p4-5935",
"aliases": [
"CVE-2019-5786"
],
"details": "Versions of `puppeteer` prior to 1.13.0 are vulnerable to the Use-After-Free vulnerability in Chromium (CVE-2019-5786). The Chromium FileReader API is vulnerable to Use-After-Free which may lead to Remote Code Execution.\n\n\n## Recommendation\n\nUpgrade to version 1.13.0 or later.",
"summary": "Use-After-Free in puppeteer",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.0"
}
]
}
],
"package": {
"name": "puppeteer",
"ecosystem": "npm"
}
}
],
"modified": "2021-09-27T16:20:33Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"published": "2020-09-02T18:25:43Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5786",
"type": "ADVISORY"
},
{
"url": "https://github.com/GoogleChrome/puppeteer/issues/4141",
"type": "WEB"
},
{
"url": "https://blog.exodusintel.com/2019/03/20/cve-2019-5786-analysis-and-exploitation",
"type": "WEB"
},
{
"url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html",
"type": "WEB"
},
{
"url": "https://crbug.com/936448",
"type": "WEB"
},
{
"url": "https://github.com/GoogleChrome/puppeteer",
"type": "PACKAGE"
},
{
"url": "https://snyk.io/vuln/SNYK-JS-PUPPETEER-174321",
"type": "WEB"
},
{
"url": "https://www.npmjs.com/advisories/824",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2019-06-27T17:15:13Z",
"github_reviewed_at": "2020-08-31T18:37:09Z"
}
}