CVE-2026-82637

MediumCVSS 5.3

Published: 30/08/2026(UTC)Updated: 02/09/2026(UTC)Translated: 30/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

In browser-use web-ui versions 2.0.0 through 3.0.0, browser settings paths are not validated in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.

Risk Assessment

Risk of unauthorized directory creation on the system, potentially leading to disruption or privilege escalation.

Recommendation

Validate input paths, restrict container privileges, and secure the Gradio interface against unauthorized access.

Other vulnerabilities in browser-use web-ui

CVE-2026-82640Medium
In browser-use web-ui versions 2.0.0 through 3.0.0, configured LLM API keys are written to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.

Original NVD description (English source)

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS