CVE-2026-92811
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.
- Published Sep 16, 2026
- CVSS 7.1 high
- 0.5% chance of exploitation in the next 30 days (EPSS)