CVE-2025-59288: microsoft microsoft/playwright
CVSS: 5.3v3.1MediumModified
AliasesGHSA-7mvr-c777-76hpCGA-36pq-36g5-4vwcCGA-4pw7-45gx-2j39CGA-57c5-528f-9777CGA-583q-j4hj-cv9rCGA-5hgw-3wc2-cr9fCGA-5hv9-9gm5-vmw8CGA-68q3-m3fv-m8c9CGA-6f9f-8v4v-7mmgCGA-6jv8-r5mv-x3cxCGA-6pmr-8mpw-cjqcCGA-79xc-mhhx-h62rCGA-7xvw-973h-xffvCGA-82hw-6pv8-53gpCGA-8mq9-g22j-93pqCGA-8wwg-fv8g-cm5cCGA-c5cr-792h-f655CGA-c649-62cw-pf9hCGA-ccvg-646r-mp8qCGA-cff4-w93c-r8fhCGA-f366-mqvv-h7hxCGA-f696-c29r-g928CGA-g7q6-hj6c-p7g3CGA-gcg6-jr3v-6vp7CGA-ghj5-4j7f-wc9jCGA-gm88-289w-6f6cCGA-gmcc-477m-rx7fCGA-h5x7-xfqv-4544CGA-h9p9-6cpg-hcrvCGA-hjfx-g6x2-m9prCGA-jgrw-5g2x-5wr7CGA-pv6c-8647-grh5CGA-pxgg-p3xm-jmvcCGA-q8f3-q63x-86f4CGA-r4w9-92pm-w9jqCGA-r938-98x4-m8p8CGA-r9w6-x67f-5236CGA-rj7p-vphm-5vrxCGA-rjp8-6vmc-jrg2CGA-rmcr-x642-7xcxCGA-v9fq-vwww-59j6CGA-vxfx-m3hx-2q95CGA-w5j3-32v7-wfhwCGA-wq2h-rh9f-v6w5CGA-xq36-gv7x-r577
Published 14-10-2025Last modified 22-02-2026
Vulnerability summary
CVE-2025-59288 is a medium (CVSS 5.3) vulnerability in microsoft microsoft/playwright. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.4% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.23%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 14-10-2025PublishedVulnerability first disclosed.
- 22-02-2026Last modifiedVulnerability information updated.
Description
Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.
CVSS metrics
4 scores · 4 sources · 2 versionsHigh 8.7Preferred score · OSV · Npm (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HSourcesSingle source
Medium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RC:CSourcesAll 3 agree
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.23%
Chance of exploitation in the next 30 days
Percentile
13%
Versus all other CVEs
30-day change
0.00 pp
From 0.23% on 19-09-2026
19-09-202619-10-2026
EPSS score0.23%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard22 products
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.11All versions (No fix recorded)
- gitlab-rails-ce-18.5All versions (No fix recorded)
- gitlab-rails-ce-18.6All versions (No fix recorded)
- gitlab-rails-ce-18.7All versions (No fix recorded)
Microsoft2 products
- microsoft/playwright≥ 1.0.0, < 1.55.1
- playwright< 1.55.1
Npm1 product
- playwright< 1.55.1
3 vendors · 25 products
