CVE-2026-55557

Name of the Vulnerable Software and Affected Versions browse-mcp versions prior to 0.8.2

Description The software contains an arbitrary file write flaw where the browser download function writes a fetched response body to a path created by join(save dir, filename) without validating the save dir variable. Additionally, the browser save state and browser load state functions honor a caller-controlled path without validation. A malicious MCP client or an autonomous agent influenced by indirect prompt injection can specify an arbitrary save dir or state path and a URL to write attacker-controlled content to any location the process can access, such as ~/.bashrc, autostart entries, or cron files, potentially leading to host code execution. Furthermore, the force fetch fallback uses a raw fetch() function that bypasses the BROWSE MCP ALLOWED ORIGINS origin fence.

Recommendations Update to browse-mcp version 0.8.2. As a temporary mitigation, restrict the exposed tools using BROWSE MCP TOOLS to exclude the browser download, browser save state, and browser load state functions.