That1Drifter vulnerabilities

Products

• browse-mcp 1

Latest That1Drifter CVEs

Newest publication first

1. CVE-2026-55557 browse-mcp: Arbitrary file write via unconfined download and state paths

   Published 2026-08-25

   High·CVSS 8.6 EPSS 0.24%

   browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download writes a fetched response body to join(save_dir, filename) without validating the caller-controlled save_dir, while browser_save_state and browser_load_state hono...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.