Executive brief
browse-mcp is a browser control tool used by AI agents and MCP clients to automate web tasks. A path traversal vulnerability in the file download and state management features allows attackers to write arbitrary files to any location on the system where the process has write access (such as shell startup files or cron jobs), enabling remote code execution on the host system.
Technical details
The vulnerability is a path traversal / arbitrary file write flaw (CWE-22) in three functions: `browser_download`, `browser_save_state`, and `browser_load_state`. These functions accept caller-controlled `save_dir` or `path` parameters without validation, allowing traversal outside intended directories using absolute paths or `..` escape sequences. An attacker controlling an MCP client, or steering an autonomous agent via prompt injection on a visited webpage, can supply a malicious path along with a URL whose response body becomes file contents, writing attacker-controlled bytes to sensitive locations (e.g., `~/.bashrc`, autostart entries, cron files). Additionally, `force_fetch` bypassed the origin allowlist (`BROWSE_MCP_ALLOWED_ORIGINS`). The vulnerability requires the attacker to either be a direct MCP caller or indirect controller of the agent, but no additional authentication or user interaction is needed once access is obtained. Patch 0.8.2 confines paths under designated roots (`~/.browse-mcp/downloads` and `~/.browse-mcp/state`), rejects absolute paths and `..` escapes, and enforces origin checks in all fetch paths.
Affected products
- That1Drifter browse-mcp <= 0.8.1
Timeline
- 2026-06-13: disclosed: Fixed in version 0.8.2
- 2026-08-25: advisory: GitHub Advisory published