CyberRota Analysis
AI-GeneratedVersions 2.0.0 through 3.0.0 of the browser-use web-ui are vulnerable due to inadequate validation of browser settings paths, enabling attackers to create directories at arbitrary locations by manipulating specific parameters. This flaw can be exploited through the unauthenticated Gradio interface, potentially leading to unauthorized access or data manipulation within the root-running container's writable areas. Organizations using these versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.