High
browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass
Type: advisorySources: OSV
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-92811
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 15:51 UTC · Revision 1
Source evidence
browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass
core-osv · Original sourcePublished 16 Sept 2026, 20:32 UTC
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.
osv:CVE-2026-92811
Complete source record
{
"id": "5e694e9aeb3928ff1558472d884daa22e73dbdd6cf6baa006a9c447aadb19a68",
"url": "https://osv.dev/vulnerability/CVE-2026-92811",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass",
"summary": "browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.",
"evidence": "osv:CVE-2026-92811",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-92811",
"aliases": [
"CVE-2026-92811"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/browserless/browserless",
"type": "GIT",
"events": [
{
"introduced": "c8287a0e5e62b6877015c83225869ac64bfb5d44"
},
{
"last_affected": "804ceac1b60cd5a8fe5163e74036ed96f366ee92"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "1.44.0"
},
{
"last_affected": "2.56.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "1.44.0"
},
{
"last_affected": "2.56.7"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"v2.56.7",
"v2.56.6",
"v2.56.5",
"v2.56.4",
"v2.56.3",
"v2.56.2",
"v2.56.1",
"v2.56.0",
"v2.55.4",
"v2.55.3",
"v2.55.2",
"v2.55.1",
"v2.55.0",
"v2.54.2",
"v2.54.1",
"v2.54.0",
"v2.53.1",
"v2.53.0",
"v2.52.2",
"v2.52.1",
"v2.52.0",
"v2.51.2",
"v2.51.1",
"v2.38.1",
"v2.38.2",
"v2.38.0",
"v2.37.1",
"v2.37.0",
"v2.36.0",
"v2.35.0",
"v2.34.1",
"v2.34.0",
"v2.34.0-beta-0",
"v2.33.0",
"v2.32.1",
"v2.32.0",
"v2.31.1",
"v2.31.0",
"v2.30.1",
"v2.30.0",
"v2.29.0",
"v2.29.0-beta-4",
"v2.29.0-beta-3",
"v2.29.0-beta-2",
"v2.29.0-beta-1",
"v2.28.0",
"v2.27.0",
"v2.26.1",
"v2.26.0",
"v2.25.2",
"v2.25.1",
"v2.25.0",
"v2.24.3",
"v2.24.2",
"v2.24.2-beta-1",
"v2.24.1",
"v2.25.0-beta-2",
"v2.24.0",
"v2.24.0-beta-5",
"v2.24.0-beta-4",
"v2.24.0-beta-3",
"v2.24.0-beta-2",
"v2.24.0-beta-1",
"v2.23.0",
"v2.22.0",
"v2.22.0-beta-5",
"v2.22.0-beta-4",
"v2.22.0-beta-3",
"v2.22.0-beta-2",
"v2.22.0-beta-1",
"v2.21.1",
"v2.21.0",
"v2.20.2",
"v2.20.1",
"v2.20.0",
"v2.19.0",
"v2.18.0",
"v2.17.1",
"v2.17.0",
"v2.17.0-beta-2",
"v2.17.0-beta-1",
"v2.16.1",
"v2.16.0",
"v2.15.0",
"v2.14.0",
"v2.13.0",
"v2.13.0-beta-1",
"v2.12.0",
"v2.12.0-beta-3",
"v2.12.0-beta-2",
"v2.9.0",
"v2.8.0",
"v2.7.1",
"v2.7.0",
"v2.6.1",
"v2.6.1-beta-3",
"v2.6.1-beta-2",
"v2.6.1-beta-1",
"v2.6.0",
"v2.5.0",
"v2.5.0-beta-4",
"v2.5.0-beta-3",
"v2.5.0-beta-2",
"v2.5.0-beta-1",
"v2.4.0",
"v2.4.0-beta-1",
"v2.3.0",
"v2.2.0",
"v2.1.1",
"v2.1.0",
"v1.61.0",
"v1.60.2",
"v1.60.1",
"v1.60.0",
"v1.58.0",
"1.57.0-puppeteer-19.7.5",
"1.57.0-chrome-stable",
"v0.0.0-beta-3",
"v0.0.0-beta-2",
"v0.0.0-beta-1",
"v0.0.0-beta",
"v1.57.0",
"v1.56.0",
"v1.53.0",
"v1.52.1",
"v1.52.0",
"v1.51.1",
"v1.51.0",
"v1.50.0",
"v1.49.1",
"v1.49.0",
"v1.48.0",
"v1.47.0",
"v1.46.0",
"v1.45.1",
"v1.44.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92811.json"
}
}
],
"modified": "2026-10-28T02:30:37.082270402Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92811.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-92811",
"https://www.vulncheck.com/advisories/browserless-1.44.0-through-2.56.7-file-protocol-restriction-bypass",
"https://github.com/browserless/browserless",
"https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.cdp.ts#L105-L135",
"https://github.com/browserless/browserless/blob/v2.50.1/src/browsers/browsers.playwright.ts",
"https://github.com/geo-chen/oss/blob/main/browserless.md"
],
"provider_metadata": {
"cwe_ids": [
"CWE-200"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92811.json"
}
},
"related_cves": [
{
"value": "CVE-2026-92811",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 504309,
"published_at": "2026-09-16T20:32:57.539+00:00"
}