CVE-2025-59288: Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate

The vulnerability lies in the browser download and installation process within Playwright, specifically for macOS. The analysis of the provided patch commit 72c62d840247d9defd87c6beb0344d456794b570 reveals that several shell scripts located in packages/playwright-core/bin/ were modified. These scripts are responsible for reinstalling different versions of Chrome and MS Edge.

The core of the vulnerability is the use of curl with the -k (or --insecure) flag. This flag explicitly tells curl to bypass SSL certificate validation, making the connection vulnerable to man-in-the-middle (MitM) attacks. An attacker on the same network could intercept the download requests and substitute the legitimate browser package with a malicious one.

The patch addresses this vulnerability by removing the -k flag from all the curl commands in the affected scripts. This enforces the default behavior of curl, which is to validate the SSL certificate of the server, thus ensuring the authenticity and integrity of the downloaded files.

The identified 'vulnerable functions' are the shell scripts themselves, as they contain the insecure command. During a Playwright installation or browser update on a macOS system, these scripts would be executed, and their names would appear in process lists or execution logs, serving as runtime indicators of the vulnerable process.