PT-2026-94083 · Browserless+1 · Browserless
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
browserless versions 1.44.0 through 2.56.7
Description
Authenticated token holders can read arbitrary files accessible to the container process because the software fails to enforce file protocol restrictions in Playwright websocket endpoints. This occurs when attackers navigate Playwright-driven browsers to file scheme URLs, bypassing the
ALLOW FILE PROTOCOL setting which defaults to false.Recommendations
Update browserless to a version later than 2.56.7.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Browserless