GHSA-m9mq-7m7q-xc6p: browse-mcp has an arbitrary file write via unconfined download and state paths

Summary

browse-mcp, an MCP server, has an arbitrary file write flaw in `browser_download`, `browser_save_state` and `browser_load_state`. Their `save_dir` and `path` arguments are not validated, so a caller controlling the MCP arguments can write attacker-supplied response bytes to any path the process can reach, such as `~/.bashrc` or a cron file, which can lead to host code execution. The `force_fetch` fallback also bypassed the `BROWSE_MCP_ALLOWED_ORIGINS` origin fence. The estimated CVSS 3.1 score is around 7.8 (High) for the local, agent-mediated case.

Mitigation

Fixed in 0.8.2. Upgrade to browse-mcp 0.8.2. The fix confines `save_dir` under `~/.browse-mcp/downloads` and the state `path` under `~/.browse-mcp/state`, rejects absolute paths and `..` escapes, reduces download filenames to a bare basename, and makes `force_fetch` honor the origin fence. Workaround: restrict `BROWSE_MCP_TOOLS` to exclude `browser_download`, `browser_save_state` and `browser_load_state`, noting this does not stop a malicious MCP client from calling them by name.

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online