@n8n/computer-use (>=0.2.0, <=0.9.0), @n8n/fs-proxy (>=0.1.0-rc1, <=0.1.0) potentially affected by CVE-2026-54309 via @n8n/mcp-browser (>=0.1.0, <=0.8.0)

@n8n/mcp-browser NPM version =0.1.0, =0.2.0, =0.1.0-rc1, =0.1.0 Source cves: CVE-2026-54309 Source advisory: SNYK:JS-N8NMCPBROWSER-17753475...

@n8n/computer-use (0.10.0) potentially affected by CVE-2026-54309 via @n8n/mcp-browser (0.9.0)

@n8n/mcp-browser NPM version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/mcp-browser and may be impacted: - @n8n/computer-use 0.10.0 Source cves: CVE-2026-54309 Source advisory: SNYK:JS-N8NMCPBROWSER-17753475...

CVE-2026-54309

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the...

CVE-2026-54309 n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the...

NPM: n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions

NPM: n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions vulnerability discovered by ? in WordPress Npm n8n versions 2.25.7...

GHSA-QRX8-25QR-5R7V n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions

Impact When @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the user, can establish an MCP session and invoke browser-control tools. Whe...

PT-2026-50175

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.25.7 n8n versions prior to 2.26.2 Description When @n8n/mcp-browser is operated in HTTP transport mode using the --transport http flag, the MCP endpoint allows session initialization and tool invocation requests without...

EUVD-2026-19144

A security vulnerability has been detected in imprvhub mcp-browser-agent up to 0.8.0. This impacts the function CallToolRequestSchema of the file src/handlers.ts of the component URL Parameter Handler. The manipulation of the argument request.params.name/request.params.arguments leads to...

CVE-2026-5607

A security vulnerability has been detected in imprvhub mcp-browser-agent up to 0.8.0. This impacts the function CallToolRequestSchema of the file src/handlers.ts of the component URL Parameter Handler. The manipulation of the argument request.params.name/request.params.arguments leads to...

CVE-2026-5607

A security vulnerability has been detected in imprvhub mcp-browser-agent up to 0.8.0. This impacts the function CallToolRequestSchema of the file src/handlers.ts of the component URL Parameter Handler. The manipulation of the argument request.params.name/request.params.arguments leads to...

CVE-2026-5607

CVE-2026-5607 affects imprvhub mcp-browser-agent up to 0.8.0. The vulnerability resides in URL Parameter Handler’s CallToolRequestSchema within src/handlers.ts where manipulating request.params.name/request.params.arguments enables server-side request forgery. Public exploit disclosure and remote...

PT-2026-30515

A security vulnerability has been detected in imprvhub mcp-browser-agent up to 0.8.0. This impacts the function CallToolRequestSchema of the file src/handlers.ts of the component URL Parameter Handler. The manipulation of the argument request.params.name/request.params.arguments leads to...