BrowserOperator browser-operator-core contains a path‑traversal flaw in the startsWith function of scripts/component_server/server.js. By manipulating the request.url parameter, an attacker can cause the server to resolve file paths that escape the intended directory. Although the flaw itself does not provide an immediate remote code execution vector, it allows reading or overwriting arbitrary files, potentially enabling further exploitation such as execution of injected code or data exfiltration.

The vulnerability exists in BrowserOperator browser-operator-core version 0.6.0 and earlier. No other product or vendor names are affected. The software is distributed under an open source license and hosted on GitHub.

The CVSS score of 6.9 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit is available publicly and can be launched remotely. Path‑traversal conditions are satisfied when the server processes incoming HTTP requests containing a crafted URL, so an attacker with network access to the exposed API can exercise the weakness.