CVE-2026-55557 browse-mcp: Arbitrary file write via unconfined download and state paths
A malicious MCP client or prompt-injected agent can write arbitrary files to sensitive system paths, potentially leading to host code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55557?
CVE-2026-55557 is a high-severity path traversal vulnerability in That1Drifter browse-mcp, published on 25 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download writes a fetched response body to join(save_dir, filename) without validating the caller-controlled save_dir, while browser_save_state and browser_load_state honor a caller-controlled path unchanged. A malicious MCP client, or an autonomous agent steered by indirect prompt injection on a visited page, can choose an arbitrary save_dir or state path and a URL whose response body becomes attacker-controlled file contents, allowing writes to any path the process can reach, including ~/.bashrc, autostart entries, or cron files, and potentially leading to host code execution. The force_fetch fallback also uses a raw fetch() that bypasses the BROWSE_MCP_ALLOWED_ORIGINS origin fence. This issue is fixed in version 0.8.2.
Weakness: CWE-22
Which versions are affected by CVE-2026-55557?
2 open source packages ship an affected version, including browse-mcp.
| Package | Affected | Fixed in |
|---|---|---|
browse-mcp npm | All versions | 0.8.2 |
browse-mcp npm | All versions | 0.8.2 |
How do I fix CVE-2026-55557?
Upgrade browse-mcp to 0.8.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-55557 being exploited?
There is no known exploitation of CVE-2026-55557 in the wild and no public exploit code.
Sources
Also known as GHSA-m9mq-7m7q-xc6p.