PT-2026-35672 · Browseroperator · Browser-Operator-Core

Brucejin · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7234

NVD

CVSS v2.0

7.5

High

AV:N/AC:L/Au:N/C:P/I:P/A:P

A weakness has been identified in BrowserOperator browser-operator-core up to 0.6.0. Affected is the function startsWith of the file scripts/component server/server.js. Executing a manipulation of the argument request.url can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7234

Affected Products

Browser-Operator-Core

References · 6

• 🔥 https://github.com/BrowserOperator/browser-operator-core/issues/96 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7234 · Security Note
• https://vuldb.com/vuln/359843/cti · Note
• https://vuldb.com/vuln/359843 · Note
• https://vuldb.com/submit/802762 · Note
• https://github.com/BrowserOperator/browser-operator-core · Note