Read the docs
TI-2020-16103 Aliases CVE-2020-26282GHSA-wmfg-55f9-j8hq

Template Injection in BrowserUp Proxy

Priority MEDIUM 51CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Selenium tests. A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been patched in version 2.1.2.

Why it matters now

EPSS 0.04829 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed browserup-proxy (browserup): 2.1.2com.browserup:browserup-proxy (Maven): 2.1.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
browserupbrowserup-proxybefore 2.1.22.1.2Patch availableCNA
—com.browserup:browserup-proxy (Maven)before 2.1.22.1.2Patch availableGHSA-wmfg-55f9-j8hq
  • browserup-proxy Vendorbrowserup Affected before 2.1.2 Fixed in 2.1.2 Patch available CNA
  • com.browserup:browserup-proxy (Maven) Vendor— Affected before 2.1.2 Fixed in 2.1.2 Patch available GHSA-wmfg-55f9-j8hq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:browserup:browserup_proxy:*:*:*:*:*:*:*:*before 2.1.2Vulnerablebrowserup
  • cpe:2.3:a:browserup:browserup_proxy:*:*:*:*:*:*:*:* Versions before 2.1.2 Vulnerable ·browserup

Remediation

  • Fix · CNA browserup-proxy (browserup) Fixed in 2.1.2
  • Fix · GHSA-wmfg-55f9-j8hq com.browserup:browserup-proxy (Maven) Fixed in 2.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26282
  2. 2026-10-03 Alias added: GHSA-wmfg-55f9-j8hq

References

Exploit 1

Patch 1

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences