Executive brief
browserless is a service that deploys headless browsers in Docker containers for automated web automation and testing. This vulnerability allows authenticated users to bypass file access restrictions and read arbitrary files from the container's filesystem, even when file protocol access is supposed to be disabled. An attacker with valid authentication credentials could extract sensitive configuration files, private keys, or application data stored on the server.
Technical details
This vulnerability is a file protocol access control bypass in browserless Playwright websocket endpoints. The vulnerability affects versions 1.44.0 through 2.56.7. Despite the ALLOW_FILE_PROTOCOL setting defaulting to false, authenticated attackers can navigate Playwright-driven browsers to file:// scheme URLs and access files readable by the container process. The attack requires valid authentication tokens but no special privileges, and exploits insufficient validation of URL schemes in websocket request handling. The root cause is a failure to properly enforce file protocol restrictions in the Playwright browser automation layer.
Affected products
- browserless browserless 1.44.0 through 2.56.7
Timeline
- 2026-09-16: disclosed