CVE-2026-55557: 
JavaScript Análisis y mitigación de vulnerabilidades

CVE-2026-55557 is an arbitrary file write vulnerability (CWE-22 / Path Traversal) in browse-mcp, a Playwright-based headless-browser MCP server for AI agents. All versions prior to 0.8.2 are affected. The vulnerability was reported privately by researcher novice-22, fixed on June 13, 2026, and publicly disclosed via GitHub Advisory GHSA-m9mq-7m7q-xc6p on August 25, 2026. It carries a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory).

The root cause (CWE-22) lies in three tool handlers that accept caller-controlled path arguments without validation. browser_download passes the caller-supplied save_dir directly to path.join(save_dir, filename) with no confinement check, while browser_save_state and browser_load_state honor an explicit path argument unchanged. Because MCP tool arguments are controlled by the MCP client — or by an autonomous agent that can be steered via indirect prompt injection embedded in a visited web page — an attacker can supply an arbitrary save_dir (e.g., ../../..) combined with a URL whose HTTP response body is attacker-controlled content, resulting in writes to any filesystem path the process can reach (e.g., ~/.bashrc, cron files, autostart entries). A secondary issue is that the force_fetch fallback used a raw fetch() call that bypassed the BROWSE_MCP_ALLOWED_ORIGINS origin fence entirely, allowing fetches to otherwise-blocked origins (GitHub Advisory, Fix PR #58).

Successful exploitation allows an attacker to write attacker-controlled bytes to any file path accessible to the browse-mcp process, including shell initialization files (~/.bashrc), cron job definitions, and autostart entries, which can lead to persistent host code execution under the user account running the server. The confidentiality, integrity, and availability impacts are all rated High in the CVSS v4.0 assessment. In agentic AI deployments, the attack surface is particularly broad because a malicious payload can be injected into a web page that the agent visits, requiring no direct access to the MCP client configuration (GitHub Advisory, Fix PR #58).

No public exploit code or in-the-wild exploitation has been reported; the NVD SSVC assessment lists exploitation as "none" and the EPSS score is 0.0. The vulnerability is not listed in the CISA KEV catalog. However, the attack is notable for its indirect prompt injection vector: a threat actor could embed a malicious instruction in a web page that, when visited by an AI agent using browse-mcp, causes the agent to invoke browser_download with an attacker-chosen save_dir and URL, requiring no direct interaction with the MCP client (GitHub Advisory, Feedly).

1. Identify a target: Confirm the target environment is running browse-mcp version ≤ 0.8.1 as an MCP server for an AI agent (e.g., Claude Code, Cursor, Codex CLI).
2. Choose an attack vector: Either (a) act as a malicious MCP client with direct tool-call access, or (b) craft a web page containing an indirect prompt injection payload that instructs the visiting AI agent to call browser_download.
3. Prepare a malicious payload URL: Host a file at an attacker-controlled URL (e.g., https://attacker.example/payload) whose HTTP response body contains the desired malicious content (e.g., a cron job entry, a backdoored ~/.bashrc line, or an SSH authorized_keys entry).
4. Invoke browser_download with a path traversal argument: Call the tool with save_dir set to a traversal path such as ../../../../../../home/user/ and the filename derived from the URL set to .bashrc, causing the response body to be written to ~/.bashrc.
5. Alternatively, exploit browser_save_state / browser_load_state: Supply an absolute or traversal path argument (e.g., /home/user/.config/autostart/evil.desktop) to write or overwrite arbitrary state files.
6. Achieve persistence / code execution: Once the target file (e.g., ~/.bashrc) is overwritten with attacker-controlled content, the payload executes the next time the user opens a shell or the autostart entry triggers, establishing persistence or a reverse shell (GitHub Advisory, Fix PR #58).

• File System: Unexpected modification timestamps on ~/.bashrc, ~/.profile, ~/.bash_profile, cron files under /etc/cron.d/ or ~/.cron, or autostart entries (e.g., ~/.config/autostart/*.desktop); files in these locations containing unfamiliar content or commands.
• File System: New or modified files in ~/.browse-mcp/downloads/ or ~/.browse-mcp/state/ with suspicious names or content inconsistent with normal agent activity.
• Logs: browse-mcp process logs showing browser_download calls with save_dir values containing .. sequences, absolute paths outside ~/.browse-mcp/, or paths pointing to shell config or cron directories.
• Network: Outbound HTTP requests from the browse-mcp process to unexpected external origins, particularly if BROWSE_MCP_ALLOWED_ORIGINS is configured but the force_fetch fallback was used (pre-patch behavior).
• Process: Unexpected child processes spawned from the browse-mcp Node.js process (e.g., /bin/bash, curl, wget, python) shortly after a browser_download or browser_load_state tool invocation.

Upgrade to browse-mcp 0.8.2 (released June 13, 2026), which confines browser_download's save_dir to ~/.browse-mcp/downloads, confines browser_save_state/browser_load_state's path to ~/.browse-mcp/state, rejects absolute paths and .. escapes, reduces download filenames to a bare basename, and enforces the origin fence in the force_fetch fallback (GitHub Release v0.8.2). As a temporary workaround (which does not protect against a malicious MCP client calling tools by name directly), restrict exposed tools via the BROWSE_MCP_TOOLS environment variable to exclude browser_download, browser_save_state, and browser_load_state. The data root can be relocated to a non-sensitive location using the BROWSE_MCP_HOME environment variable (GitHub Advisory).