CVE-2026-55557: browse-mcp has an arbitrary file write via unconfined download and state paths

browser_download wrote the fetched file to join(save_dir, filename) with no check on save_dir. browser_save_state and browser_load_state used an explicit path as given. The MCP caller picks these arguments, and so does the URL whose response body becomes the file content. An attacker who controls the caller can therefore drop a file anywhere the browse-mcp process can write, such as ~/.bashrc, an autostart entry or a cron file. That can turn into code execution on the host.

The attacker is either a malicious MCP client or, more commonly, content that steers an agent: a visited web page carrying an indirect prompt injection that tells the agent to call browser_download with a chosen save_dir. No account on the host is needed.

A second flaw sat in the force_fetch fallback. It used a raw fetch() that skipped the BROWSE_MCP_ALLOWED_ORIGINS origin fence, so a download could reach origins you had blocked.

The advisory rates the local, agent-mediated case around CVSS 7.8. The data panel carries a CVSS 4.0 score of 8.6.

npm package browse-mcp version 0.8.1 and earlier. The three tools affected are browser_download, browser_save_state and browser_load_state. Servers started with BROWSE_MCP_TOOLS set to a list that leaves them out do not expose them to an agent, though the advisory notes a malicious client can still call them by name.

Check:

npm ls -g browse-mcp
npm ls browse-mcp

If you launch it with npx, check which version your MCP client config pins.

Upgrade to 0.8.2:

npm install [email protected]

The release confines save_dir under ~/.browse-mcp/downloads and explicit state paths under ~/.browse-mcp/state. Absolute paths and .. escapes are rejected, and download filenames are cut to a bare basename. force_fetch now honors BROWSE_MCP_ALLOWED_ORIGINS and BROWSE_MCP_BLOCKED_ORIGINS. Set BROWSE_MCP_HOME to move the data roots.

Workaround from the advisory: set BROWSE_MCP_TOOLS to a set that excludes browser_download, browser_save_state and browser_load_state (SECURITY.md has a hardened recipe). This hides the tools from an agent but does not stop a malicious MCP client, so upgrade.

Review MCP tool-call logs for browser_download, browser_save_state or browser_load_state calls whose save_dir or path is absolute or contains ... Then check the files those paths point at: shell startup files (~/.bashrc, ~/.profile), autostart entries and cron files for recent changes you did not make.

Beam records agent MCP tool calls and file access, and its rules can flag writes to shell startup files, which is where this flaw would show up.

Impact

browser_download wrote a fetched file to join(save_dir, filename) with no validation of save_dir, and browser_save_state / browser_load_state honored an explicit path unchanged. The MCP caller controls these arguments (a malicious MCP client, or an autonomous agent steered by indirect prompt injection on a visited page), so an attacker could supply an arbitrary save_dir (or state path) together with a URL whose response body became the file contents, writing attacker-controlled bytes to any path the process can reach (for example ~/.bashrc, an autostart entry, or a cron file). That is an arbitrary file write that can lead to host code execution. The force_fetch fallback additionally used a raw fetch() that bypassed the BROWSE_MCP_ALLOWED_ORIGINS origin fence.

Estimated severity: CVSS 3.1 around 7.8 (High) for the local / agent-mediated case.

Patches

Fixed in 0.8.2. save_dir is confined under the download root (~/.browse-mcp/downloads) and the explicit state path under ~/.browse-mcp/state; absolute paths and .. escapes are rejected, and download filenames are reduced to a bare basename. force_fetch now also honors the origin fence. Data roots remain relocatable via BROWSE_MCP_HOME. Upgrade to browse-mcp 0.8.2.

Workarounds

Restrict the exposed tools with BROWSE_MCP_TOOLS to a set that excludes browser_download, browser_save_state, and browser_load_state (for example the hardened recipe in SECURITY.md). Note that the allowlist hides the tools from an agent but does not stop a malicious MCP client from calling them by name, so upgrading is the real fix.

• Reported privately by novice-22.