GHSA-m9mq-7m7q-xc6p: browse-mcp has an arbitrary file write via unconfined download and state paths
Summary
browse-mcp versions before 0.8.2 had a critical security flaw where file download and state management functions didn't properly check file paths, allowing attackers to write files to any location on the system (like startup scripts or configuration files) and potentially execute code. The vulnerability could be exploited by malicious MCP clients (software components that interact with the browser tool) or through prompt injection (tricking an AI by hiding instructions in web page content).
Solution / Mitigation
Fixed in version 0.8.2. The patch confines file downloads to a specific directory (~/.browse-mcp/downloads) and state files to (~/.browse-mcp/state), rejects absolute paths and directory escape sequences (..), strips filenames to their base names only, and enforces the origin fence (allowed website restrictions) on all fetches. Users should upgrade to browse-mcp 0.8.2.
Vulnerability Details
EPSS: 0.0%
Yes
August 25, 2026
Classification
Taxonomy References
Affected Vendors
Affected Packages
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://github.com/advisories/GHSA-m9mq-7m7q-xc6p
First tracked: August 25, 2026 at 02:01 PM
Classified by LLM (prompt v3) · confidence: 92%