Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
GitHub scored the path-traversal bug 8.6 and named prompt injection as the likely delivery path.
Why now: The risk stays live for any browse-mcp install that hasn't upgraded past 0.8.2, since prompt injection is the advisory's stated way in.
A path-traversal bug in browse-mcp lets a hostile web page choose where an AI agent writes files on disk, per GitHub's security advisory. For an agent with file-system access, a hostile page could overwrite configuration files, plant scripts, or drop files anywhere the process's account can reach, well outside the download folder the tool is supposed to write to.
The flaw, cataloged as CVE-2026-55557 with a CVSS score of 8.6, traces to the browser_download tool. It writes a downloaded response body to join(save_dir, filename) without checking the caller-supplied save_dir. The state save and load tools take the same shortcut, honoring whatever path the caller hands them.
The advisory names indirect prompt injection as the realistic trigger. An agent reads a page loaded with hidden instructions, and the page tells the agent where to save its own output. No code execution required, just a path the server never validated.
Browse-mcp fixed the bug in version 0.8.2.
Each link below shares sources, entities, or timing with this story.
Windsurf uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Windsurf uses MCP); both cover CVE, GHSA; reported by the same outlet (github.com).
Google released MCP / Shared entity: MCP / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Google released MCP); both cover MCP; reported by the same outlet (github.com).
Anthropic released MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Anthropic released MCP); both cover CVE, MCP; reported by the same outlet (github.com).
headroom uses MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (headroom uses MCP); both cover MCP, Playwright; reported by the same outlet (github.com).
Claude Code uses MCP / Shared entity: MCP / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover MCP; reported by the same outlet (github.com).
Claude Code uses MCP / Shared entities / Earlier coverage / Tension
Linked by a graph relationship (Claude Code uses MCP); both cover Fixed, MCP; earlier Fixed coverage from 2026-08-05.
Cursor uses MCP / Shared entity: MCP / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Cursor uses MCP); both cover MCP; reported by the same outlet (github.com).
Anthropic released MCP / Shared entities / Earlier coverage / Tension
Linked by a graph relationship (Anthropic released MCP); both cover CVE, MCP; earlier CVE coverage from 2026-07-23.