{"id":"EUVD-2025-34363","enisaUuid":"48065570-e7fd-3f47-831b-8d4a3e73c2e9","description":"Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.","datePublished":"Oct 14, 2025, 5:00:49 PM","dateUpdated":"Feb 22, 2026, 5:24:58 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RC:C","references":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59288\n","aliases":"CVE-2025-59288\nGHSA-7mvr-c777-76hp\n","assigner":"microsoft","epss":0.23,"enisaIdProduct":[{"id":"912cdad8-7a47-33b2-8a28-7c330cacd43a","product":{"name":"microsoft/playwright","vendor":{"name":"Microsoft"}},"product_version":"1.0.0 \u003c1.55.1"}],"enisaIdVendor":[{"id":"3bfd1ef6-2d93-348c-bc1f-369d5e210fdd","vendor":{"name":"Microsoft"}}],"enisaIdVulnerability":[{"id":"6924dcb9-21a4-3563-a661-f4523b73fec6","vulnerability":{"id":"CVE-2025-59288","description":"Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.","datePublished":"Oct 14, 2025, 5:00:49 PM","dateUpdated":"Feb 22, 2026, 5:24:58 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RC:C","references":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59288\n","enisa_id":"EUVD-2025-34363\n","assigner":"microsoft","epss":0.23,"dataProcessed":"Nov 4, 2026, 7:13:38 AM","vulnerabilityProduct":[{"id":"a08ccf1e-9796-3704-9332-3e103539f672","product":{"name":"microsoft/playwright","vendor":{"name":"Microsoft"}},"product_version":"1.0.0 \u003c1.55.1"}],"vulnerabilityVendor":[{"id":"9b012910-6cdc-34f0-8d35-2c26108cf781","vendor":{"name":"Microsoft"}}]}},{"id":"9784d569-fbf2-356a-ba38-dc03ef192f95","vulnerability":{"id":"GHSA-7mvr-c777-76hp","description":"Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate","datePublished":"Oct 14, 2025, 6:30:36 PM","dateUpdated":"Oct 24, 2025, 8:05:47 PM","baseScore":0.0,"references":"https://github.com/SocketDev/security-research/security/advisories/GHSA-qxm8-4v54-964r\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59288\nhttps://github.com/microsoft/playwright/pull/37532\nhttps://github.com/microsoft/playwright/commit/72c62d840247d9defd87c6beb0344d456794b570\nhttps://github.com/microsoft/playwright\nhttps://github.com/microsoft/playwright/releases/tag/v1.55.1\nhttps://github.com/microsoft/playwright/releases/tag/v1.56.0\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59288\n","enisa_id":"EUVD-2025-34363\n","aliases":"GHSA-7mvr-c777-76hp\nCVE-2025-59288\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:55:38 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"822fe49c-c344-33a5-8f5b-7fea078ab49c","advisory":{"id":"msrc_CVE-2025-59288","description":"Playwright Spoofing Vulnerability","datePublished":"Oct 14, 2025, 7:00:00 AM","dateUpdated":"Oct 14, 2025, 7:00:00 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59288\nhttps://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-59288.json\n","aliases":"CVE-2025-59288\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"0d02c61e-4f0b-394a-9b06-ba23ed85d15b","product":{"name":"1.55.1"}},{"id":"30227707-3eba-33a6-8479-4fb7a787dfea","product":{"name":"microsoft/playwright","vendor":{"name":"Microsoft"}}},{"id":"f2c69d43-1c21-3fe1-a151-ad2ca55d5eb5","product":{"name":"microsoft/playwright 1.55.1","vendor":{"name":"microsoft/playwright"}}}]}}]}