PT-2025-42148 · Github · Github

Published 2025-10-14 · Updated 2026-06-04 · CVE-2025-59288

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions GitHub (affected versions not specified)

Description An improper verification of a cryptographic signature allows an unauthorized attacker to perform spoofing over an adjacent network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2025-59288

GHSA-7MVR-C777-76HP

Affected Products

Github

References · 17

• https://osv.dev/vulnerability/GHSA-7mvr-c777-76hp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59288 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59288 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-59288 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59288 · Security Note
• https://github.com/microsoft/playwright/releases/tag/v1.55.1 · Note
• https://github.com/microsoft/playwright/commit/72c62d840247d9defd87c6beb0344d456794b570 · Note
• https://github.com/microsoft/playwright/pull/37532 · Note
• https://github.com/microsoft/playwright/releases/tag/v1.56.0 · Note
• https://github.com/microsoft/playwright · Note
• https://reddit.com/r/AgentZero/comments/1s4ma5t/devs_close_the_security_holes_in_this_app · Reddit Post
• https://t.me/cveNotify/140546 · Telegram Post
• https://reddit.com/r/AgentZero/comments/1s4m9gy/devs_close_your_security_holes_this_app_is · Reddit Post
• https://t.me/cveNotify/143524 · Telegram Post
• https://github.com/SocketDev/security-research/security/advisories/GHSA-qxm8-4v54-964r · Note