CVE-2026-82637

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

CVE-2026-82640

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

CVE-2026-82640 browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

CVE-2026-82640 browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

CVE-2026-82640 browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

CVE-2026-82640

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

EUVD-2026-68216

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

CVE-2026-82640

browser-use web-ui versions 2.0.0 through 3.0.0 store configured LLM API keys in cleartext on disk without encryption or access restrictions. The keys are written to predictably-named JSON files in a temporary settings directory, allowing any process or user with local read access to recover prov...

CVE-2026-82637 browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

CVE-2026-82637 browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

CVE-2026-82637

browser-use web-ui versions 2.0.0 through 3.0.0 contain an arbitrary directory creation vulnerability in the run_agent_task function. The affected parameters (save_recording_path , save_trace_path , save_agent_history_path , save_download_path ) accept unvalidated absolute paths, and the attack i...

EUVD-2026-68213

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

CVE-2026-82637

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

CVE-2026-82637 browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

CVE-2026-82637: External Control of File Name or Path

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

PT-2026-83557

Name of the Vulnerable Software and Affected Versions browser-use web-ui versions 2.0.0 through 3.0.0 Description The software fails to validate browser settings paths within the run agent task function. This allows unauthenticated users to create directories at arbitrary locations on the system...

CVE-2026-82640: Cleartext Storage of Sensitive Information

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

PT-2026-83560

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...