CVE-2025-59288 Playwright Spoofing Vulnerability
An attacker can spoof content by bypassing cryptographic signature verification in the Playwright library over an adjacent network.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59288?
CVE-2025-59288 is a medium-severity vulnerability in microsoft/playwright, published on 14 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.
Weakness: CWE-347
Which versions are affected by CVE-2025-59288?
2 open source packages ship an affected version, including playwright. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
playwright npm | All versions | 1.55.1 |
playwright npm | All versions | 1.55.1 |
Products include Microsoft Playwright.
How do I fix CVE-2025-59288?
Upgrade playwright to 1.55.1 or later.
Is CVE-2025-59288 being exploited?
There is no known exploitation of CVE-2025-59288 in the wild and no public exploit code.
Sources
Also known as GHSA-7mvr-c777-76hp, ROOT-APP-NPM-CVE-2025-59288.