browse-mcp Lets a Prompt-Injected Agent Write Files Anywhere on Disk (CVE-2026-55557)
GitHub Security Advisories·medium signal
Published 2026-08-25 at 8.6 HIGH, this affects browse-mcp, a Playwright headless-browser MCP server for agents. `browser_download` writes a fetched response body to `join(save_dir, filename)` without validating the caller-supplied `save_dir`, while `browser_save_state` and `browser_load_state` honor a caller-controlled path unchanged. The advisory explicitly names the delivery path as "an autonomous agent steered by indirect prompt injection," which is the realistic case: a browsing agent reads a hostile page, and the page tells it where to write. Fixed in 0.8.2.