Description
browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download writes a fetched response body to join(save_dir, filename) without validating the caller-controlled save_dir, while browser_save_state and browser_load_state honor a caller-controlled path unchanged. A malicious MCP client, or an autonomous agent steered by indirect prompt injection on a visited page, can choose an arbitrary save_dir or state path and a URL whose response body becomes attacker-controlled file contents, allowing writes to any path the process can reach, including ~/.bashrc, autostart entries, or cron files, and potentially leading to host code execution. The force_fetch fallback also uses a raw fetch() that bypasses the BROWSE_MCP_ALLOWED_ORIGINS origin fence. This issue is fixed in version 0.8.2.
Published: 2026-08-25
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary File Write
Action: Immediate Patch
AI Analysis

Impact

browse-mcp is a headless-browser (MCP – the abbreviation is inferred to mean Micro Content Provisioning) server that writes output files to caller-provided paths without validating them. An attacker who can control the save_dir or state path and supply a URL that returns attacker-controlled data can cause the server to write arbitrary files to any location reachable by the server process, including user configuration files, autostart entries, or cron jobs. This flaw, classified as CWE‑22, enables potential host code execution if critical system files are overwritten. The vulnerability allows an attacker to inject malicious content via a remote MCP client or via indirect prompt injection on a visited page, resulting in uncontrolled file writes and possible escalation of privileges.

Affected Systems

The affected product is browse-mcp from That1Drifter. Versions prior to v0.8.2 are vulnerable, with the issue fixed in v0.8.2 and later releases.

Risk and Exploitability

The vulnerability carries a high CVSS score of 8.6, with no EPSS data available and it currently does not appear in the CISA KEV catalog. Attackers can exploit the flaw by connecting as an MCP client over the network or by steering an autonomous agent through indirect prompt injection. Because the server writes to arbitrary paths, the impact is determined by the account under which the server runs; a user-level process can modify hidden user files, while a system-level process can alter critical system files, potentially leading to remote code execution.

Generated by OpenCVE AI on August 25, 2026 at 20:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update browse-mcp to version v0.8.2 or later to apply the path validation fix.
  • Restrict access to the MCP server by using firewall rules or network segmentation so that only trusted clients can connect.
  • Monitor critical directories (e.g., ~/.bashrc, /etc/cron.d, autostart locations) for unexpected file creations or modifications to detect potential exploitation attempts.

Generated by OpenCVE AI on August 25, 2026 at 20:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-m9mq-7m7q-xc6p browse-mcp has an arbitrary file write via unconfined download and state paths
History

Fri, 28 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared That1drifter
That1drifter browse-mcp
Vendors & Products That1drifter
That1drifter browse-mcp

Tue, 25 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Description browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download writes a fetched response body to join(save_dir, filename) without validating the caller-controlled save_dir, while browser_save_state and browser_load_state honor a caller-controlled path unchanged. A malicious MCP client, or an autonomous agent steered by indirect prompt injection on a visited page, can choose an arbitrary save_dir or state path and a URL whose response body becomes attacker-controlled file contents, allowing writes to any path the process can reach, including ~/.bashrc, autostart entries, or cron files, and potentially leading to host code execution. The force_fetch fallback also uses a raw fetch() that bypasses the BROWSE_MCP_ALLOWED_ORIGINS origin fence. This issue is fixed in version 0.8.2.
Title browse-mcp: Arbitrary file write via unconfined download and state paths
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

That1drifter Browse-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-25T19:00:25.437Z

Reserved: 2026-06-16T23:11:20.213Z

Link: CVE-2026-55557

cve-icon Vulnrichment

Updated: 2026-08-25T19:00:21.989Z

cve-icon NVD

Status : Deferred

Published: 2026-08-25T17:17:32.357

Modified: 2026-09-09T21:07:31.353

Link: CVE-2026-55557

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T20:36:40Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')