{"id":"CVE-2026-92811","summary":"browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass","details":"browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.","modified":"2026-09-18T03:48:42.951922919Z","published":"2026-09-16T20:32:57.539Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92811.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92811.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92811"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/browserless-1.44.0-through-2.56.7-file-protocol-restriction-bypass"},{"type":"PACKAGE","url":"https://github.com/browserless/browserless"},{"type":"ARTICLE","url":"https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.cdp.ts#L105-L135"},{"type":"ARTICLE","url":"https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.playwright.ts"},{"type":"EVIDENCE","url":"https://github.com/geo-chen/oss/blob/main/browserless.md"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/browserless/browserless","events":[{"introduced":"c8287a0e5e62b6877015c83225869ac64bfb5d44"},{"fixed":"804ceac1b60cd5a8fe5163e74036ed96f366ee92"}],"database_specific":{"extracted_events":[{"introduced":"1.44.0"},{"last_affected":"2.56.7"},{"fixed":"2.56.7"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v2.56.6","v2.56.5","v2.56.4","v2.56.3","v2.56.2","v2.56.1","v2.56.0","v2.55.4","v2.55.3","v2.55.2","v2.55.1","v2.55.0","v2.54.2","v2.54.1","v2.54.0","v2.53.1","v2.53.0","v2.52.2","v2.52.1","v2.52.0","v2.51.2","v2.51.1","v2.38.1","v2.38.2","v2.38.0","v2.37.1","v2.37.0","v2.36.0","v2.35.0","v2.34.1","v2.34.0","v2.34.0-beta-0","v2.33.0","v2.32.1","v2.32.0","v2.31.1","v2.31.0","v2.30.1","v2.30.0","v2.29.0","v2.29.0-beta-4","v2.29.0-beta-3","v2.29.0-beta-2","v2.29.0-beta-1","v2.28.0","v2.27.0","v2.26.1","v2.26.0","v2.25.2","v2.25.1","v2.25.0","v2.24.3","v2.24.2","v2.24.2-beta-1","v2.24.1","v2.25.0-beta-2","v2.24.0","v2.24.0-beta-5","v2.24.0-beta-4","v2.24.0-beta-3","v2.24.0-beta-2","v2.24.0-beta-1","v2.23.0","v2.22.0","v2.22.0-beta-5","v2.22.0-beta-4","v2.22.0-beta-3","v2.22.0-beta-2","v2.22.0-beta-1","v2.21.1","v2.21.0","v2.20.2","v2.20.1","v2.20.0","v2.19.0","v2.18.0","v2.17.1","v2.17.0","v2.17.0-beta-2","v2.17.0-beta-1","v2.16.1","v2.16.0","v2.15.0","v2.14.0","v2.13.0","v2.13.0-beta-1","v2.12.0","v2.12.0-beta-3","v2.12.0-beta-2","v2.9.0","v2.8.0","v2.7.1","v2.7.0","v2.6.1","v2.6.1-beta-3","v2.6.1-beta-2","v2.6.1-beta-1","v2.6.0","v2.5.0","v2.5.0-beta-4","v2.5.0-beta-3","v2.5.0-beta-2","v2.5.0-beta-1","v2.4.0","v2.4.0-beta-1","v2.3.0","v2.2.0","v2.1.1","v2.1.0","v1.61.0","v1.60.2","v1.60.1","v1.60.0","v1.58.0","1.57.0-puppeteer-19.7.5","1.57.0-chrome-stable","v0.0.0-beta-3","v0.0.0-beta-2","v0.0.0-beta-1","v0.0.0-beta","v1.57.0","v1.56.0","v1.53.0","v1.52.1","v1.52.0","v1.51.1","v1.51.0","v1.50.0","v1.49.1","v1.49.0","v1.48.0","v1.47.0","v1.46.0","v1.45.1","v1.44.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92811.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}