browser-use

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

browser-use records in CISA KEV

No browser-use vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-56975 CVE-2026-82637 · GHSA-hhqw-gcq9-6cmv

browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

HIGH 70

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_pat…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00412 Published 2026-08-30 No fix listed CWE-73

TI-2025-29794 CVE-2025-47241 · GHSA-x39x-9qw5-ghrf

In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is…

MEDIUM 52

In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.

CVSS 3.1MEDIUM 4.0 Network No auth No interaction EPSS 0.00462 Published 2025-05-03 Fixed in 0.1.45 CWE-647

TI-2026-56978 CVE-2026-82640 · GHSA-jrjf-ww9v-c67g

browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage

LOW 28

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00072 Published 2026-08-30 No fix listed CWE-312

Open these records in search →

Critical	0
High	0
Medium	3
Low	0
No CVSS	0