Path Traversal in browserless-chrome

HIGH 7.5CVE-2020-7758 · GHSA-8p9r-f949-699g · SNYK-JS-BROWSERLESSCHROME-1023657 · Published 02/11/2020 · updated 17/06/2026

In short

CVE-2020-7758 is a HIGH (CVSS 7.5) vulnerability affecting chrome (browserless), browserless-chrome.
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.4% of all vulnerabilities.
Fix: update to 1.40.2, 1.43.0 or later.

Package	Affected versions	Patched versions
chrome browserless	`< 1.40.2`	`1.40.2`
browserless-chrome npm	`< 1.43.0`	`1.43.0`

Description

This affects all versions of browserless-chrome before 1.43.0. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.

NVD description

This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.

References

nvd.nist.gov/vuln/detail/CVE-2020-7758 · ADVISORY
browserless/chrome commit 848b87e · WEB
browserless/chrome · PACKAGE
browserless/chrome · WEB
browserless/chrome release 1.40.2-chrome-stable · WEB
snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657 · WEB
npmjs.com/package/browserless-chrome · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free