Puppeteer browsers v3.2.5 patches symlink escape and path traversal vulnerabilities
Puppeteer released v3.2.5 of its browsers package, fixing a symlink chain escape during zip extraction and a path traversal issue from buildId, along with a fix for alias removal on uninstall.
Briefing
- Puppeteer: Puppeteer released v3.2.5 of its browsers package, fixing a symlink chain escape during zip extraction and a path traversal issue from buildId, along with a fix for alias removal on uninstall.
Why it matters
These fixes address security concerns in browser management tooling, particularly around zip extraction and path traversal, which could be exploited during automated browser setup. The alias removal fix also improves reliability for users managing multiple browser installations. While a routine patch, it highlights ongoing maintenance of security boundaries in extraction workflows.
Sources
- Primary source · Puppeteer · 2026-10-14 — puppeteer/puppeteer browsers: v3.2.5
Watch next
Will further security audits of browser management tooling uncover additional vulnerabilities in zip extraction or path handling?