THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-m9mq-7m7q-xc6p (high) — browse-mcp has an arbitrary file write via unconfined download and state paths

[GHSA] GHSA-m9mq-7m7q-xc6p (high) — browse-mcp has an arbitrary file write via unconfined download and state paths

medgithub_advisoriesPublished 2026-08-25

GHSA-m9mq-7m7q-xc6p Severity: high CVE: CVE-2026-55557

browse-mcp has an arbitrary file write via unconfined download and state paths

### Impact `browser_download` wrote a fetched file to `join(save_dir, filename)` with no validation of `save_dir`, and `browser_save_state` / `browser_load_state` honored an explicit `path` unchanged. The MCP caller controls these arguments (a malicious MCP client

Indicators of compromise

CVE-2026-55557cve

Original source: https://github.com/advisories/GHSA-m9mq-7m7q-xc6p