A path traversal vulnerability in the browser-operator-core component server allows unauthenticated attackers to read sensitive files from the host filesystem.

This is a path traversal flaw (CWE-22) residing in the startsWith function within scripts/component_server/server.js. An unauthenticated attacker can manipulate the request.url parameter to bypass directory restrictions and access files outside the intended root directory.

Successful exploitation permits unauthorized access to sensitive files accessible by the component server process, potentially leading to the exposure of credentials, configuration files, or proprietary source code. While the CVSS score of 7.3 reflects a significant risk, the impact is highly dependent on the sensitivity of the data stored within the server environment. This vulnerability poses a serious threat to confidentiality, particularly in development or CI/CD pipelines where the software is deployed.

Immediate Action: As no official patch is currently available, immediately restrict access to the component server endpoint to trusted internal networks only. Ensure the server is not exposed to the public internet or untrusted users.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests containing directory traversal sequences, such as multiple consecutive dot-dot-slash patterns (../). Investigate any unexpected file access requests originating from unknown or unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or a reverse proxy configured to sanitize incoming HTTP requests and block paths containing traversal characters. Avoid running the component server in environments that contain sensitive files under the same directory tree.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up linked in the GitHub issue tracker for the project.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability requires immediate attention. Organizations must prioritize isolating the affected component server from all untrusted network segments. Security teams should maintain heightened vigilance until a formal update is released by the vendor to address the underlying path sanitization logic.