| Package | Affected versions | Patched versions |
|---|---|---|
| chrome | < 1.40.2 | 1.40.2 |
| browserless-chrome | < 1.43.0 | 1.43.0 |
This affects all versions of browserless-chrome before 1.43.0. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free