Vulnerabilidades de Browser-use
CVEs publicadas que afetam produtos de Browser-use: 2 registro(s), com severidade, exploração e correções.
CVE-2026-82640
Média · 5.5
CWE-312 30/08/2026
browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage
browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.
CVE-2026-82637
Média · 5.3
CWE-73 30/08/2026
browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation
browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.