CVE-2026-55557: browse-mcp Path Traversal Vulnerability

CVE-2026-55557 Overview

CVE-2026-55557 is a path traversal vulnerability [CWE-22] in browse-mcp, a Playwright-based headless-browser Model Context Protocol (MCP) server used by MCP-capable agents. Versions prior to 0.8.2 fail to validate caller-controlled destination paths in the browser_download, browser_save_state, and browser_load_state tools. A malicious MCP client, or an autonomous agent influenced by indirect prompt injection on a visited page, can write attacker-controlled bytes to any path the process can reach. The force_fetch fallback additionally uses a raw fetch() that bypasses the BROWSE_MCP_ALLOWED_ORIGINS origin fence. The issue is fixed in version 0.8.2.

Critical Impact
Arbitrary file write to locations such as ~/.bashrc, autostart entries, or cron files can lead to host code execution under the browse-mcp process context.

Affected Products

browse-mcp versions prior to 0.8.2
MCP-capable agents integrating browse-mcp for headless browsing
Playwright-based automation stacks using the vulnerable server

Discovery Timeline

2026-08-25 - CVE-2026-55557 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55557

Vulnerability Analysis

The browse-mcp server exposes tools that accept caller-supplied filesystem destinations. In browser_download, the fetched HTTP response body is written to join(save_dir, filename) without validating that save_dir remains inside an expected data root. The browser_save_state and browser_load_state tools honor a caller-controlled path argument unchanged, allowing reads and writes at absolute locations.

Because MCP agents can be steered by prompt content embedded in web pages, the caller boundary is effectively untrusted. An adversary who controls a page the agent visits can influence the agent to invoke browser_download with a URL whose response body becomes the file contents and a save_dir pointing anywhere the process can reach. This converts a benign download primitive into arbitrary file write with attacker-controlled bytes.

A secondary issue exists in the force_fetch fallback, which uses a raw fetch() call. This bypass ignores the BROWSE_MCP_ALLOWED_ORIGINS origin fence intended to constrain outbound HTTP targets.

Root Cause

The root cause is missing path confinement on caller-supplied destinations combined with a network fetch primitive that circumvents the origin allowlist. Neither .. traversal segments nor absolute paths are rejected before writes occur.

Attack Vector

Exploitation requires that a client of the MCP server, whether a malicious client or an autonomous agent influenced by indirect prompt injection, supply a destination path outside the intended data root. Writing to ~/.bashrc, XDG autostart files, or cron entries leads to code execution the next time those files are processed.

typescript

// Security patch: src/pathSafe.ts — introduces path confinement
import { resolve, sep, posix } from 'path';

/**
 * Confine a caller-supplied path to a root directory. `requested` is resolved
 * (relative entries against `root`, absolute entries as given); the result must
 * be `root` itself or a descendant, otherwise this throws.
 */
export function confineToDir(root: string, requested?: string): string {
  const base = resolve(root);
  if (requested == null || requested === '') return base;
  const target = resolve(base, requested);
  if (target !== base && !target.startsWith(base + sep)) {
    throw new Error(
      `Refusing path outside the allowed directory: ${JSON.stringify(requested)} ` +
        `resolves outside ${base}. Pass a path under it, or relocate the root with BROWSE_MCP_HOME.`,
    );
  }
  return target;
}

Source: GitHub Commit 5352a4a

Detection Methods for CVE-2026-55557

Indicators of Compromise

Unexpected modifications to shell initialization files such as ~/.bashrc, ~/.zshrc, or ~/.profile under the browse-mcp process user
New or modified files under ~/.config/autostart/, ~/.config/systemd/user/, or crontab entries created by the browse-mcp process
browse-mcp download or state files written outside BROWSE_MCP_HOME or the default downloads directory
Outbound fetch() requests to origins not present in BROWSE_MCP_ALLOWED_ORIGINS

Detection Strategies

Audit browse-mcp tool invocations for save_dir or path arguments containing .. sequences or absolute paths outside the data root
Compare filesystem write telemetry from the Node.js process hosting browse-mcp against an allowlist of expected directories
Alert on child process spawns whose parent is a shell started after modification of user startup files

Monitoring Recommendations

Enable process and file integrity monitoring for user home directories and cron directories on hosts running MCP agents
Log all MCP tool arguments centrally to enable retrospective search for path traversal patterns
Monitor outbound HTTP connections from the browse-mcp process for deviations from the configured origin allowlist

How to Mitigate CVE-2026-55557

Immediate Actions Required

Upgrade browse-mcp to version 0.8.2 or later on every host running the MCP server
Inventory all MCP agents and autonomous workflows that load browse-mcp and confirm they resolve to the patched release
Review recent filesystem writes and cron or autostart changes on affected hosts for signs of exploitation

Patch Information

The fix is delivered in browse-mcp 0.8.2. The patch introduces confineToDir and safeBasename helpers in src/pathSafe.ts and applies origin fence checks to the force_fetch fallback. See the GitHub Security Advisory GHSA-m9mq-7m7q-xc6p, the GitHub Release v0.8.2, and Pull Request #58.

Workarounds

Run browse-mcp as a low-privilege user with no write access to home startup files, cron, or autostart directories
Constrain the process with a mandatory access control profile (AppArmor, SELinux) limiting writable paths to a dedicated data root
Set BROWSE_MCP_HOME to an isolated directory and enforce it with filesystem permissions
Restrict outbound network access from the browse-mcp host to a curated allowlist at the network layer, not only via BROWSE_MCP_ALLOWED_ORIGINS

bash

# Configuration example: run browse-mcp under a dedicated user and data root
sudo useradd --system --home /var/lib/browse-mcp --shell /usr/sbin/nologin browsemcp
sudo install -d -o browsemcp -g browsemcp -m 0750 /var/lib/browse-mcp
export BROWSE_MCP_HOME=/var/lib/browse-mcp
export BROWSE_MCP_ALLOWED_ORIGINS="https://example.com,https://api.example.com"
sudo -u browsemcp env BROWSE_MCP_HOME=$BROWSE_MCP_HOME \
  BROWSE_MCP_ALLOWED_ORIGINS=$BROWSE_MCP_ALLOWED_ORIGINS \
  npx browse-mcp@0.8.2