CVE-2026-92811
browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.
| CWE | CWE-200 |
| Vendor | browserless |
| Product | browserless |
| Published | Sep 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for browserless browserless
Be the first to know when new medium vulnerabilities affecting browserless browserless are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
browserless / browserless
1.44.0 ≤ 2.56.7
References
github.com: https://github.com/geo-chen/oss/blob/main/browserless.md github.com: https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.cdp.ts#L105-L135 github.com: https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.playwright.ts github.com: https://github.com/browserless/browserless vulncheck.com: https://www.vulncheck.com/advisories/browserless-1.44.0-through-2.56.7-file-protocol-restriction-bypass
Credits
George Chen