CVE-2019-5786: Use-After-Free in puppeteer
Summary
CVE-2019-5786: Use-After-Free in puppeteer. Affects puppeteer versions < 1.13.0. Fixed in 1.13.0. How to fix ↓
Also tracked for
- chromium · Debian:11
The same CVE-2019-5786 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Puppeteer is an open-source Node.js library that provides a high-level API for controlling headless Chrome or Chromium browsers. It allows developers to automate tasks such as generating screenshots, PDFs, and crawling websites. Puppeteer is widely used for web scraping, testing, and automation purposes. However, versions prior to 1.13.0 are vulnerable to a Use-After-Free vulnerability in Chromium (CVE-2019-5786). This vulnerability specifically affects the Chromium FileReader API, which can be exploited to achieve Remote Code Execution.
Vulnerability Detail
The Use-After-Free vulnerability in the Chromium FileReader API, present in vulnerable versions of Puppeteer, can have severe consequences. An attacker can exploit this vulnerability to execute arbitrary code remotely. The vulnerability occurs when the FileReader API is used after the associated object has been freed from memory. By manipulating the freed object, an attacker can gain control over the program's execution flow and execute malicious code. This can lead to unauthorized access, data theft, or further compromise of the system.
How To Fix
Minimum fixed version
1.13.0
This is the first release that contains the fix.
npm install puppeteer@1.13.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of Puppeteer to mitigate the risk of exploitation.
Conclusion
The Use-After-Free vulnerability in Puppeteer (CVE-2019-5786) can have serious consequences, allowing remote code execution. It is essential to upgrade to version 1.13.0 or later of Puppeteer to fix this vulnerability. By updating to the latest version, developers can ensure that the vulnerable FileReader API in Chromium is patched and no longer susceptible to exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for puppeteer →
FAQ
Puppeteer is a Node.js library that provides a high-level API for controlling headless Chrome or Chromium browsers. It is commonly used for web scraping, testing, and automation tasks.
A Use-After-Free vulnerability occurs when a program uses a memory object after it has been freed. In the case of this vulnerability, the FileReader API in Puppeteer is used after the associated object has been freed, allowing an attacker to manipulate the freed object and execute arbitrary code.
The impact of this vulnerability can be severe. An attacker can exploit it to execute arbitrary code remotely, potentially leading to unauthorized access, data theft, or further compromise of the system.
To fix this vulnerability, you should upgrade to version 1.13.0 or later of Puppeteer. Updating to the latest version ensures that the vulnerable FileReader API in Chromium is patched and no longer susceptible to the Use-After-Free vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to update to the fixed version of Puppeteer to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for puppeteer.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
