CVE-2026-92811

EUVD-2026-81069
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/browserless/browserless
https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.cdp.ts#L105-L135
https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.playwright.ts
https://github.com/geo-chen/oss/blob/main/browserless.md
https://www.vulncheck.com/advisories/browserless-1.44.0-through-2.56.7-file-protocol-restriction-bypass