CVE-2026-55557: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in That1Drifter browse-mcp

The browse-mcp server, a Playwright-based headless-browser MCP server, improperly limits pathname access when writing fetched response bodies to disk. Specifically, before version 0.8.2, the browser_download function writes to a path constructed from a caller-controlled save_dir and filename without validating the save_dir. Additionally, browser_save_state and browser_load_state accept caller-controlled paths without validation. An attacker controlling an MCP client or indirectly influencing an autonomous agent can specify arbitrary paths and URLs, causing attacker-controlled file writes anywhere the process has access, including sensitive configuration files. The force_fetch fallback uses a raw fetch() call that bypasses the BROWSE_MCP_ALLOWED_ORIGINS origin fence, increasing the attack surface. This vulnerability is addressed in browse-mcp version 0.8.2.

An attacker can write arbitrary files to the host filesystem with the privileges of the browse-mcp process. This includes overwriting critical files such as user shell configuration files (~/.bashrc), autostart entries, or cron jobs, which may lead to remote code execution on the host. The vulnerability does not require user interaction or privileges and can be exploited by a malicious MCP client or through indirect prompt injection influencing an autonomous agent. The origin restriction bypass further facilitates exploitation by allowing fetches from unauthorized origins.

A fix is available in browse-mcp version 0.8.2. Users should upgrade to version 0.8.2 or later to remediate this vulnerability. No other mitigation steps are indicated by the vendor advisory.