CVE-2026-92811
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-200
Revelación de información
Fecha de publicación:
16/09/2026
Última modificación:
22/09/2026
Descripción
*** Pendiente de traducción *** browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.
Impacto
Puntuación base 4.0
7.10
Gravedad 4.0
ALTA
Puntuación base 3.x
6.50
Gravedad 3.x
MEDIA
Referencias a soluciones, herramientas e información
- https://github.com/browserless/browserless
- https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.cdp.ts#L105-L135
- https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.playwright.ts
- https://github.com/geo-chen/oss/blob/main/browserless.md
- https://www.vulncheck.com/advisories/browserless-1.44.0-through-2.56.7-file-protocol-restriction-bypass