Search
Find a vulnerability
Search criteria
4 vulnerabilities by browserless
CVE-2026-92811 (GCVE-0-2026-92811)
Vulnerability from nvd – Published: 2026-09-16 20:32 – Updated: 2026-09-21 15:40
VLAI
EPSS
VEX
Title
browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass
Summary
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:40 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/browser… | technical-descriptionexploit |
| https://github.com/browserless/browserless/blob/v… | technical-description |
| https://github.com/browserless/browserless/blob/v… | technical-description |
| https://github.com/browserless/browserless | product |
| https://www.vulncheck.com/advisories/browserless-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| browserless | browserless |
Affected:
1.44.0 , ≤ 2.56.7
(semver)
cpe:2.3:a:browserless:chrome:*:*:*:*:*:*:*:* |
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92811",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:40:03.577982Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:40:14.058Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "browserless",
"vendor": "browserless",
"versions": [
{
"lessThanOrEqual": "2.56.7",
"status": "affected",
"version": "1.44.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:browserless:chrome:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.56.7",
"versionStartIncluding": "1.44.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:57.539Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/browserless.md"
},
{
"name": "the CDP class enforces getAllowFileProtocol",
"tags": [
"technical-description"
],
"url": "https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.cdp.ts#L105-L135"
},
{
"name": "the Playwright class never consults the setting",
"tags": [
"technical-description"
],
"url": "https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.playwright.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/browserless/browserless"
},
{
"name": "VulnCheck Advisory: browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/browserless-1.44.0-through-2.56.7-file-protocol-restriction-bypass"
}
],
"title": "browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92811",
"datePublished": "2026-09-16T20:32:57.539Z",
"dateReserved": "2026-09-16T19:55:01.357Z",
"dateUpdated": "2026-09-21T15:40:14.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-7758 (GCVE-0-2020-7758)
Vulnerability from nvd – Published: 2020-11-02 18:30 – Updated: 2024-09-16 20:42
VLAI
EPSS
VEX
Title
Path Traversal
Summary
This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.
Severity
CWE
- Path Traversal
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657 | x_refsource_MISC |
| https://github.com/browserless/chrome/blob/master… | x_refsource_MISC |
| https://github.com/browserless/chrome/commit/848b… | x_refsource_MISC |
| https://github.com/browserless/chrome/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | browserless-chrome |
Affected:
before 1.40.2-chrome-stable
|
Date Public
2020-11-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:41:01.614Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/browserless/chrome/blob/master/src/routes.ts%23L175"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/browserless/chrome/commit/848b87e5bea4f8473eea85261a5ff922d6ebd2b6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "browserless-chrome",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "before 1.40.2-chrome-stable"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Snyk Security Team"
}
],
"datePublic": "2020-11-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "PROOF_OF_CONCEPT",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "REASONABLE",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:R",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Path Traversal",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-18T02:36:08.000Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/browserless/chrome/blob/master/src/routes.ts%23L175"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/browserless/chrome/commit/848b87e5bea4f8473eea85261a5ff922d6ebd2b6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable"
}
],
"title": "Path Traversal",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "report@snyk.io",
"DATE_PUBLIC": "2020-11-02T18:27:18.886549Z",
"ID": "CVE-2020-7758",
"STATE": "PUBLIC",
"TITLE": "Path Traversal"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "browserless-chrome",
"version": {
"version_data": [
{
"version_value": "before 1.40.2-chrome-stable"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Snyk Security Team"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:R",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Path Traversal"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657",
"refsource": "MISC",
"url": "https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657"
},
{
"name": "https://github.com/browserless/chrome/blob/master/src/routes.ts%23L175",
"refsource": "MISC",
"url": "https://github.com/browserless/chrome/blob/master/src/routes.ts%23L175"
},
{
"name": "https://github.com/browserless/chrome/commit/848b87e5bea4f8473eea85261a5ff922d6ebd2b6",
"refsource": "MISC",
"url": "https://github.com/browserless/chrome/commit/848b87e5bea4f8473eea85261a5ff922d6ebd2b6"
},
{
"name": "https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable",
"refsource": "MISC",
"url": "https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2020-7758",
"datePublished": "2020-11-02T18:30:22.046Z",
"dateReserved": "2020-01-21T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:42:47.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-92811 (GCVE-0-2026-92811)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-21 15:40
VLAI
EPSS
VEX
Title
browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass
Summary
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:40 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/browser… | technical-descriptionexploit |
| https://github.com/browserless/browserless/blob/v… | technical-description |
| https://github.com/browserless/browserless/blob/v… | technical-description |
| https://github.com/browserless/browserless | product |
| https://www.vulncheck.com/advisories/browserless-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| browserless | browserless |
Affected:
1.44.0 , ≤ 2.56.7
(semver)
cpe:2.3:a:browserless:chrome:*:*:*:*:*:*:*:* |
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92811",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:40:03.577982Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:40:14.058Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "browserless",
"vendor": "browserless",
"versions": [
{
"lessThanOrEqual": "2.56.7",
"status": "affected",
"version": "1.44.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:browserless:chrome:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.56.7",
"versionStartIncluding": "1.44.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:57.539Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/browserless.md"
},
{
"name": "the CDP class enforces getAllowFileProtocol",
"tags": [
"technical-description"
],
"url": "https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.cdp.ts#L105-L135"
},
{
"name": "the Playwright class never consults the setting",
"tags": [
"technical-description"
],
"url": "https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.playwright.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/browserless/browserless"
},
{
"name": "VulnCheck Advisory: browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/browserless-1.44.0-through-2.56.7-file-protocol-restriction-bypass"
}
],
"title": "browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92811",
"datePublished": "2026-09-16T20:32:57.539Z",
"dateReserved": "2026-09-16T19:55:01.357Z",
"dateUpdated": "2026-09-21T15:40:14.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-7758 (GCVE-0-2020-7758)
Vulnerability from cvelistv5 – Published: 2020-11-02 18:30 – Updated: 2024-09-16 20:42
VLAI
EPSS
VEX
Title
Path Traversal
Summary
This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.
Severity
CWE
- Path Traversal
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657 | x_refsource_MISC |
| https://github.com/browserless/chrome/blob/master… | x_refsource_MISC |
| https://github.com/browserless/chrome/commit/848b… | x_refsource_MISC |
| https://github.com/browserless/chrome/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | browserless-chrome |
Affected:
before 1.40.2-chrome-stable
|
Date Public
2020-11-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:41:01.614Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/browserless/chrome/blob/master/src/routes.ts%23L175"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/browserless/chrome/commit/848b87e5bea4f8473eea85261a5ff922d6ebd2b6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "browserless-chrome",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "before 1.40.2-chrome-stable"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Snyk Security Team"
}
],
"datePublic": "2020-11-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "PROOF_OF_CONCEPT",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "REASONABLE",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:R",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Path Traversal",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-18T02:36:08.000Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/browserless/chrome/blob/master/src/routes.ts%23L175"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/browserless/chrome/commit/848b87e5bea4f8473eea85261a5ff922d6ebd2b6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable"
}
],
"title": "Path Traversal",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "report@snyk.io",
"DATE_PUBLIC": "2020-11-02T18:27:18.886549Z",
"ID": "CVE-2020-7758",
"STATE": "PUBLIC",
"TITLE": "Path Traversal"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "browserless-chrome",
"version": {
"version_data": [
{
"version_value": "before 1.40.2-chrome-stable"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Snyk Security Team"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:R",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Path Traversal"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657",
"refsource": "MISC",
"url": "https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657"
},
{
"name": "https://github.com/browserless/chrome/blob/master/src/routes.ts%23L175",
"refsource": "MISC",
"url": "https://github.com/browserless/chrome/blob/master/src/routes.ts%23L175"
},
{
"name": "https://github.com/browserless/chrome/commit/848b87e5bea4f8473eea85261a5ff922d6ebd2b6",
"refsource": "MISC",
"url": "https://github.com/browserless/chrome/commit/848b87e5bea4f8473eea85261a5ff922d6ebd2b6"
},
{
"name": "https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable",
"refsource": "MISC",
"url": "https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2020-7758",
"datePublished": "2020-11-02T18:30:22.046Z",
"dateReserved": "2020-01-21T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:42:47.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}