CVE-2026-7234 BrowserOperator browser-operator-core server.js startsWith path traversal

A weakness has been identified in BrowserOperator browser-operator-core up to 0.6.0. Affected is the function startsWith of the file scripts/componentserver/server.js. Executing a manipulation of the argument request.url can lead to path traversal. The attack can be launched remotely. The exploit...

browser-operator-core 路径遍历漏洞

Browser-Operator-core is a privacy-first AI browser developed by BrowserOperator. It supports local execution and multi-agent automation. Versions of Browser-Operator-core prior to 0.6.0 have a path traversal vulnerability. This vulnerability stems from the request.url parameter in the startsWith...

PT-2026-35672

A weakness has been identified in BrowserOperator browser-operator-core up to 0.6.0. Affected is the function startsWith of the file scripts/component server/server.js. Executing a manipulation of the argument request.url can lead to path traversal. The attack can be launched remotely. The exploi...

CVE-2026-7234: Improper Limitation of a Pathname to a Restricted Directory

A weakness has been identified in BrowserOperator browser-operator-core up to 0.6.0. Affected is the function startsWith of the file scripts/componentserver/server.js. Executing a manipulation of the argument request.url can lead to path traversal. The attack can be launched remotely. The exploit...