High (AgentArmorHQ estimate)Code executionAugust 25, 2026

browse-mcp has an arbitrary file write via unconfined download and state paths

Product: browse-mcp
CVE: CVE-2026-55557
Affected: browse-mcp <= 0.8.1
Fixed in: 0.8.2

Last verified against sources: October 26, 2026

Am I affected?

browse-mcp: affected browse-mcp <= 0.8.1. Fixed in 0.8.2.

Check your version: run npm ls browse-mcp. Versions <= 0.8.1 of browse-mcp are affected. [1]

What to do now

Upgrade to the fixed version: run npm install browse-mcp@0.8.2 (first patched version 0.8.2). [1]
Upgrade to browse-mcp 0.8.2. [1]
Restrict the exposed tools with BROWSE_MCP_TOOLS to a set that excludes browser_download, browser_save_state, and browser_load_state. [1]

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

Discuss this incident

What happened

browser_download wrote a fetched file to join(save_dir, filename) with no validation of save_dir. [1]
browser_save_state / browser_load_state honored an explicit path unchanged. [1]
The force_fetch fallback additionally used a raw fetch() that bypassed the BROWSE_MCP_ALLOWED_ORIGINS origin fence. [1]

Impact

An attacker could supply an arbitrary save_dir (or state path) together with a URL whose response body became the file contents, writing attacker-controlled bytes to any path the process can reach. [1]
That is an arbitrary file write that can lead to host code execution. [1]

What was done

Fixed in 0.8.2. [1]
save_dir is confined under the download root (~/.browse-mcp/downloads) and the explicit state path under ~/.browse-mcp/state; absolute paths and .. escapes are rejected, and download filenames are reduced to a bare basename. [1]
force_fetch now also honors the origin fence. [1]
Reported privately by novice-22. [1]

Sources

GHSA-m9mq-7m7q-xc6p — GitHub Advisory Database

Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.

Copy a plain-text summary for Slack, GitHub issues, or team security channels.

Brief

[CVE-2026-55557] browse-mcp has an arbitrary file write via unconfined download and state paths
Product: browse-mcp | Affected: browse-mcp <= 0.8.1 | Fixed in: 0.8.2
Summary: `browser_download` wrote a fetched file to `join(save_dir, filename)` with no validation of `save_dir`.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/08/cve-2026-55557-browse-mcp

Was this page useful?

Corrections

Report an error or request a correction. We review requests within 5 business days and add a dated correction note.

Discussions for CVE-2026-55557

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

← All incidents Related tools in directory Check package