GHSA-F54F-HR32-586F Duplicate Advisory: `allowed_domains` can be bypassed by putting a decoy domain in http auth username portion of a URL

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x39x-9qw5-ghrf. This link is maintained to preserve external references. Original Description In browser-use aka Browser Use before 0.1.45, URL parsing of alloweddomains is mishandled because userinfo can be...

CVE-2025-47241

In browser-use aka Browser Use before 0.1.45, URL parsing of alloweddomains is mishandled because userinfo can be placed in the authority component...

CVE-2025-47241: Use of Non-Canonical URL Paths for Authorization Decisions

In browser-use aka Browser Use before 0.1.45, URL parsing of alloweddomains is mishandled because userinfo can be placed in the authority component...

CVE-2025-47241

In browser-use aka Browser Use before 0.1.45, URL parsing of alloweddomains is mishandled because userinfo can be placed in the authority component...

CVE-2025-47241

CVE-2025-47241 affects the browser-use (Browser Use) project prior to 0.1.45. The root cause is incorrect handling of userinfo in the authority component during URL parsing of allowed_domains in BrowserContextConfig._is_url_allowed(): the code strips the port from netloc with domain.split(':')[0]...

CVE-2025-47241

In browser-use aka Browser Use before 0.1.45, URL parsing of alloweddomains is mishandled because userinfo can be placed in the authority component...

Browser Use security vulnerabilities

Browser Use is an open source application from Browser Use. Allows AI agents to access websites. A security vulnerability exists in versions of Browser Use prior to 0.1.45 that stems from improper URL parsing of alloweddomains, which could lead to user information being placed in the authorizatio...

CVE-2025-47241

In browser-use aka Browser Use before 0.1.45, URL parsing of alloweddomains is mishandled because userinfo can be placed in the authority component...

ambientagi (>=0.1.1, <=0.2.12), kolega-code (>=0.1.0, <=0.3.0) +7 more potentially affected by CVE-2025-47241 via browser-use (>=0.1.19, <=0.1.41)

browser-use PYPI version =0.1.19, =0.1.1, =0.1.0, =0.1.0, =0.1.15, =0.1.1, =0.1.1, =2.1.1, =0.1.0, =0.13.0, =0.14.1 Source cves: CVE-2025-47241 Source advisory: MEND:CVE-2025-47241...

Authorization Bypass Through User-Controlled Key

Overview browser-use is a Make websites accessible for AI agents Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to the default settings disablesecurity=True and --remote-debugging-address=0.0.0.0. A remote attacker can execute arbitrary...

ambientagi (>=0.1.1, <=0.2.12), kolega-code (>=0.1.0, <=0.3.0) +7 more potentially affected by unknown CVE via browser-use (>=0.1.19, <=0.1.40)

browser-use PYPI version =0.1.19, =0.1.1, =0.1.0, =0.1.15, =0.1.1, =0.1.1, =2.1.1, =0.1.0, =0.13.0, =0.14.1 Source cves: unknown CVE Source advisory: SNYK:PYTHON-BROWSERUSE-12304093...

Access Control Bypass

Overview browser-use is a Make websites accessible for AI agents Affected versions of this package are vulnerable to Access Control Bypass via the server's configuration, an attacker can access the debug port, which was inadvertently exposed on all network interfaces. Remediation Upgrade...

ambientagi (>=0.1.1, <=0.2.12), kolega-code (>=0.1.0, <=0.3.0) +7 more potentially affected by unknown CVE via browser-use (>=0.1.19, <=0.1.40)

browser-use PYPI version =0.1.19, =0.1.1, =0.1.0, =0.1.15, =0.1.1, =0.1.1, =2.1.1, =0.1.0, =0.13.0, =0.14.1 Source cves: unknown CVE Source advisory: SNYK:PYTHON-BROWSERUSE-12304092...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...