The browse-mcp headless-browser server is affected by a path traversal vulnerability that could lead to full system file access.

This is a path traversal vulnerability (CWE-22) residing in the browse-mcp server, which allows an unauthenticated attacker to manipulate file paths and access restricted directories on the host.

With a CVSS score of 8.6, this vulnerability poses a critical risk to the host server. An attacker could potentially read sensitive configuration files, environment variables, or other private data stored on the filesystem, leading to complete compromise of the server instance.

Immediate Action: Update browse-mcp to version 0.8.2 or later to apply the necessary path sanitization fixes.

Proactive Monitoring: Review system and application access logs for attempts to access unexpected file paths or directory traversal patterns, such as sequences containing dot-dot-slash.

Compensating Controls: Ensure the service is running with the least privilege necessary, ideally within a containerized environment with a restricted filesystem mount.

Public Exploit Available: No (exploit_available: false)

Given the potential for total system impact, users of the browse-mcp server must upgrade to version 0.8.2 immediately. Restricting network access to this service until the patch is applied is strongly advised to mitigate the risk of unauthorized file system access.