This vulnerability involves a path traversal weakness in the startsWith function of the browser-operator-core component of BrowserOperator (versions 0.1 through 0.6.0). By manipulating the request.url parameter, an attacker can perform path traversal attacks remotely, potentially accessing files outside the intended directory scope. The vulnerability is publicly known and exploitable, but no official patch or remediation has been released by the vendor as of the published date.

Successful exploitation allows an unauthenticated remote attacker to perform path traversal, potentially accessing sensitive files on the affected system. This could lead to information disclosure or further attacks depending on the files accessed. The CVSS score of 6.9 reflects a medium impact with low complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as input validation or restricting access to the affected component until an official patch is available.