EUVD-2026-81069
GHSA-w2m9-jxm7-c4jp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable websocket endpoint (AV:N/AC:L), requires a valid API token (PR:L), no user interaction; arbitrary file read gives C:H while integrity and availability are unaffected (I:N/A:N), scope unchanged within the container.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.
AnalysisAI
Authenticated token holders can drive the Playwright websocket endpoints of browserless to file:// URLs and read arbitrary files available to the container process, affecting versions 1.44.0 through 2.56.7. The setting intended to prevent this, ALLOW_FILE_PROTOCOL, already defaults to false, but it is simply not enforced on the Playwright path, so exploitation requires no non-default configuration and no user interaction - only a valid token (CVSS vector PR:L) and network reachability to the websocket endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid browserless authentication token (PR:L) and network reachability to the Playwright websocket endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded information-disclosure issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the only references supplied are source-file links rather than a fixed release, so monitor https://github.com/browserless/browserless and the VulnCheck advisory at https://www.vulncheck.com/advisories/browserless-1.44.0-through-2.56.7-file-protocol-restriction-bypass for a patched version and upgrade immediately once one is published - until then, do not rely on ALLOW_FILE_PROTOCOL, since it is already false by default and is exactly the control that fails on the Playwright path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every deployment of browserless and confirm which are running versions 1.44.0 through 2.56.7; restrict network reachability to the Playwright websocket endpoint so that only trusted application hosts can connect, and audit and rotate any tokens that authenticate to that endpoint, treating existing tokens as potentially compromised until proven otherwise. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today