Threats affecting pkg:github/cloakhq/CloakBrowser

CVE-2026-45727 is a path traversal vulnerability in CloakHQ's CloakBrowser versions prior to 0.3.28. The cloakserve CDP multiplexer improperly uses a user-supplied fingerprint parameter as a filesystem path component without validation. This allows an unauthenticated attacker who can access the cloakserve port to craft a fingerprint value that traverses directories outside the intended data directory. As a result, when Chrome fails to start or the process is cleaned up, arbitrary directories outside the intended scope can be deleted. The service is exposed by default on all network interfaces (0.0.0.0), increasing exposure risk.