{"data":{"id":"3ae00be3-20e2-41ae-a425-6c3e2bb5f4d8","title":"GHSA-m9mq-7m7q-xc6p: browse-mcp has an arbitrary file write via unconfined download and state paths","summary":"browse-mcp versions before 0.8.2 had a critical security flaw where file download and state management functions didn't properly check file paths, allowing attackers to write files to any location on the system (like startup scripts or configuration files) and potentially execute code. The vulnerability could be exploited by malicious MCP clients (software components that interact with the browser tool) or through prompt injection (tricking an AI by hiding instructions in web page content).","solution":"Fixed in version 0.8.2. The patch confines file downloads to a specific directory (~/.browse-mcp/downloads) and state files to (~/.browse-mcp/state), rejects absolute paths and directory escape sequences (..), strips filenames to their base names only, and enforces the origin fence (allowed website restrictions) on all fetches. Users should upgrade to browse-mcp 0.8.2.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-m9mq-7m7q-xc6p","publishedAt":"2026-08-25T16:28:32.000Z","cveId":"CVE-2026-55557","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["browse-mcp@<= 0.8.1 (fixed: 0.8.2)"],"affectedVendors":[],"affectedVendorsRaw":["browse-mcp"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-08-25T16:28:32.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":["AML.T0010"]}}