The Pega Browser Extension used by Pegasystems Pega Robot Studio allows a Robot Runtime user to write files to the local filesystem when a malicious website is visited. This flaw can be leveraged to create or overwrite arbitrary files, potentially installing malware or corrupting critical data, thereby compromising the integrity of the automation environment.

Pegasystems Pega Robot Studio Robotic Automation versions 22.1 and R25 are affected, particularly when automations operate through Google Chrome or Microsoft Edge. Users running these versions in environments that permit web navigation are at risk.

The CVSS score of 7.2 indicates high severity. Although an EPSS score is unavailable, the vulnerability is not excluded from public exploitation. The attack requires a Robot Runtime user or automated process to access a crafted website that hosts malicious code. Once accessed, the extension writes files in the context of the user or automation, enabling a local escalation of privileges and potential lateral spread if privileged files are overwritten.