Browserless vulnerabilities
2 vulnerabilities
Known vulnerabilities in Browserless products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2- Browserless1 vulnerabilities
- Chrome1 vulnerabilities
CVE-2020-7758browserlesschrome+1
EPSS score2.18%
This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.CVE-2026-92811browserlessbrowserlessEPSS score0.45%
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.