CVE-2026-92811: browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOWFILEPROTOCOL setting defaulting to false.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
browserlessto a version that resolves this vulnerability.Fixed in 1.44.0 through 2.56.7 - Compensating control
Apply a compensating control to prevent access to file:// URLs via Playwright websocket endpoints in browserless until the File Protocol Restriction Bypass is patched.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid browserless authentication token and access to a Playwright websocket endpoint. The issue exposes files that are readable by the browserless container process.
Does disabling file protocol access with ALLOW_FILE_PROTOCOL prevent exploitation?
No. The affected Playwright websocket endpoints do not enforce the file protocol restriction, even when ALLOW_FILE_PROTOCOL is left at its default value of false.
Which deployments should be investigated?
Investigate browserless deployments running versions 1.44.0 through 2.56.7 that expose or provide access to Playwright websocket endpoints. Assess what files the container process can read, since those are the files potentially accessible through this issue.