Executive brief
A security vulnerability exists in the imprvhub mcp-browser-agent, a tool used to allow AI agents to interact with web browsers and APIs. An attacker can exploit this flaw to force the agent to make unauthorized network requests to internal systems or sensitive web addresses. This could lead to the exposure of private internal data or unauthorized access to restricted corporate services that are not normally accessible from the public internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in imprvhub mcp-browser-agent through version 0.8.0. The vulnerability is located in the `CallToolRequestSchema` handler within `src/handlers.ts`, which passes user-controlled arguments (`request.params.name` and `request.params.arguments`) to the `executeToolCall` function in `src/executor.ts`. Specifically, the `browser_navigate` and various API tools (GET, POST, etc.) fail to validate the `url` parameter before passing it to sensitive sinks like Playwright's `page.goto()` or `APIRequestContext`. A remote attacker with access to the MCP interface can provide crafted URLs to probe internal network services, access cloud metadata endpoints, or bypass network restrictions. As of the advisory date, the vendor has not responded to the disclosure and no patch is available.
Affected products
- imprvhub mcp-browser-agent up to 0.8.0
Timeline
- 2026-03-21: disclosed: Vulnerability reported by independent researcher via GitHub issue.
- 2026-04-06: advisory: NVD and VulDB published the vulnerability details.