THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-82637 (MEDIUM 5.3) — browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_downloa

[NVD] CVE-2026-82637 (MEDIUM 5.3) — browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_downloa

mednvdPublished 2026-08-30

CVE-2026-82637 CVSS: 5.3 MEDIUM Published: 2026-08-30T14:17:03.470

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via th

Indicators of compromise

CVE-2026-82637cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82637