Vulnerability Description
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/browserless/browserless
- https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.cd
- https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.pl
- https://github.com/geo-chen/oss/blob/main/browserless.md
- https://www.vulncheck.com/advisories/browserless-1.44.0-through-2.56.7-file-prot
FAQ
What is CVE-2026-92811?
CVE-2026-92811 is a vulnerability with a CVSS score of 6.5 (MEDIUM). browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can nav...
How severe is CVE-2026-92811?
CVE-2026-92811 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92811?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.