Threats tagged 'ghsa-x39x-9qw5-ghrf'

The browser_use module implements a domain whitelist to restrict URL navigation, but this check can be bypassed by embedding a whitelisted domain in the HTTP basic authentication username portion of a URL. This allows unauthorized access to domains outside the whitelist, including internal services. The vulnerability affects all versions prior to 0.1.45 and has a critical severity with a CVSS score of 9.3. A fix is available in version 0.1.45.