28 matches found
firefox-devtools-mcp
Firefox DevTools MCP Model Context Protocol server that lets AI agents use Firefox. It has two main use cases: Agentic browsing : the agent uses the browser for regular tasks, such as reading pages, filling forms and going through multi-step flows on websites. Agent-assisted web development : the...
firefox-devtools-mcp v0.10.3
Firefox DevTools MCP Model Context Protocol server for automating Firefox via WebDriver BiDi through Selenium WebDriver. Works with Claude Code, Claude Desktop, Cursor, Cline and other MCP clients. Repository: https://github.com/mozilla/firefox-devtools-mcp Note : This MCP server requires a local...
firefox-devtools-mcp v0.10.2
Firefox DevTools MCP Model Context Protocol server for automating Firefox via WebDriver BiDi through Selenium WebDriver. Works with Claude Code, Claude Desktop, Cursor, Cline and other MCP clients. Repository: https://github.com/mozilla/firefox-devtools-mcp Note : This MCP server requires a local...
firefox-devtools-mcp v0.10.0
Firefox DevTools MCP Model Context Protocol server for automating Firefox via WebDriver BiDi through Selenium WebDriver. Works with Claude Code, Claude Desktop, Cursor, Cline and other MCP clients. Repository: https://github.com/mozilla/firefox-devtools-mcp Note : This MCP server requires a local...
CVE-2026-53766
creationtimestamp| type| source ---|---|--- 2026-08-17 22:35:16+00:00| published-proof-of-concept| https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-8qf9-62x2-82pp 2026-08-18 02:33:46+00:00| seen| https://gist.github.com/alon710/259d2014ae004d0972fa015a9b341f1e...
chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an...
NPM: chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
NPM: chrome-devtools-mcp: validatePath does not canonicalize symlinks before enforcing roots vulnerability discovered by ? in WordPress Npm chrome-devtools-mcp versions = 0.24.0, = 1.0.1...
browser-ipc-cdp (>=2.0.0, <=3.13.0), chrome-devtools-mcp-docker (>=0.1.5, <=0.1.7) +1 more potentially affected by CVE-2026-53766 via chrome-devtools-mcp (0.25.0)
chrome-devtools-mcp NPM version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on chrome-devtools-mcp and may be impacted: - browser-ipc-cdp =2.0.0, =0.1.5, =1.0.1, =1.0.9 Source cves: CVE-2026-53766 Source advisory: GHSA-8QF9-62X2-82PP...
browser-ipc-cdp (>=2.0.0, <=3.13.0), chrome-devtools-mcp-docker (>=0.1.5, <=0.1.7) +1 more potentially affected by CVE-2026-53766 via chrome-devtools-mcp (0.25.0)
chrome-devtools-mcp NPM version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on chrome-devtools-mcp and may be impacted: - browser-ipc-cdp =2.0.0, =0.1.5, =1.0.1, =1.0.9 Source cves: CVE-2026-53766 Source advisory: OSV:GHSA-8QF9-62X2-82PP...
GHSA-8QF9-62X2-82PP chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an...
firefox-devtools-mcp v0.9.15
Firefox DevTools MCP Model Context Protocol server for automating Firefox via WebDriver BiDi through Selenium WebDriver. Works with Claude Code, Claude Desktop, Cursor, Cline and other MCP clients. Repository: https://github.com/mozilla/firefox-devtools-mcp Note : This MCP server requires a local...
Directory Traversal
Overview chrome-devtools-mcp is a MCP server for Chrome DevTools Affected versions of this package are vulnerable to Directory Traversal through the validatePath function. An attacker can access or modify files outside the intended workspace boundaries by leveraging symlinks that point to locatio...
browser-ipc-cdp (>=2.0.0, <=3.13.0), chrome-devtools-mcp-docker (>=0.1.5, <=0.1.7) +1 more potentially affected by CVE-2026-53766 via chrome-devtools-mcp (0.25.0)
chrome-devtools-mcp NPM version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on chrome-devtools-mcp and may be impacted: - browser-ipc-cdp =2.0.0, =0.1.5, =1.0.1, =1.0.9 Source cves: CVE-2026-53766 Source advisory:...
CVE-2026-53766
Chrome DevTools for agents chrome-devtools-mcp lets your coding agent control and inspect a live Chrome browser. From 0.24.0 until 1.1.0, McpContext.validatePath enforces workspace roots by checking whether path.resolvefilePath textually falls under one of the configured root paths. path.resolve...
CVE-2026-53765 chrome-devtools-mcp: daemon.pid write follows symlinks in /tmp fallback runtime directory
Chrome DevTools for agents chrome-devtools-mcp lets your coding agent control and inspect a live Chrome browser. From 0.20.0 until 1.1.0, The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync to a deterministic runtime path. On typical macOS environments, and on Linux sessions...
CVE-2026-53765
CVE-2026-53765 / GHSA-3PVJ-JV98-QHJQ affects chrome-devtools-mcp (Chrome DevTools for agents). The vulnerability occurs when the daemon writes its PID file to a deterministic runtime path under /tmp on POSIX systems (macOS or Linux with XDG_RUNTIME_DIR unset). The code uses fs.writeFileSync() wit...
CVE-2026-53765
Chrome DevTools for agents chrome-devtools-mcp lets your coding agent control and inspect a live Chrome browser. From 0.20.0 until 1.1.0, The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync to a deterministic runtime path. On typical macOS environments, and on Linux sessions...
EUVD-2026-39105
Chrome DevTools for agents chrome-devtools-mcp lets your coding agent control and inspect a live Chrome browser. From 0.20.0 until 1.1.0, The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync to a deterministic runtime path. On typical macOS environments, and on Linux sessions...
@liqi0816/chrome-devtools-mcp-rebrowser (>=1.0.0, <=1.0.3), @mallocfeng/chromedev (>=0.1.0, <=0.1.8) +11 more potentially affected by CVE-2026-53765 via chrome-devtools-mcp (>=0.20.3, <=0.25.0)
chrome-devtools-mcp NPM version =0.20.3, =1.0.0, =0.1.0, =0.2.8, =0.2.7, =2.0.0, =0.1.5, =0.1.49, =1.0.5, =1.0.0, =1.0.1, =1.0.9 Source cves: CVE-2026-53765 Source advisory: MEND:CVE-2026-53765...
CVE-2026-53766 chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
Chrome DevTools for agents chrome-devtools-mcp lets your coding agent control and inspect a live Chrome browser. From 0.24.0 until 1.1.0, McpContext.validatePath enforces workspace roots by checking whether path.resolvefilePath textually falls under one of the configured root paths. path.resolve...