CVE-2020-7758: Path Traversal in browserless-chrome
Summary
CVE-2020-7758: Path Traversal in browserless-chrome. Affects browserless-chrome versions < 1.43.0. Fixed in 1.43.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
browserless-chrome is an npm package that provides a headless Chrome browser. It allows users to interact with Chrome programmatically, enabling tasks such as web scraping, automated testing, and generating PDFs. This vulnerability affects all versions of browserless-chrome prior to 1.43.0. The package is vulnerable to a path traversal attack, where user input from the workspace endpoint is used to construct a file path. An attacker can exploit this vulnerability to access arbitrary files on the server.
Vulnerability Detail
The vulnerability arises due to the insecure handling of user input in the creation of a file path. The filePath variable is constructed using user input from the workspace endpoint and is subsequently fetched and sent back to the user. By manipulating the user input, an attacker can escape the intended file path and retrieve sensitive files from the server. This can lead to unauthorized access, disclosure of sensitive information, and potential compromise of the server's security.
How To Fix
Latest published version: 1.44.0 as of 22 Oct 2026
npm install browserless-chrome@1.44.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.43.0
This is the first release that contains the fix.
npm install browserless-chrome@1.43.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to implement input validation and sanitization on the server-side. This can be done by carefully validating and filtering user input to ensure that it does not contain any directory traversal characters or sequences. Additionally, access controls should be implemented to restrict file access based on user privileges and permissions.
Conclusion
The path traversal vulnerability in browserless-chrome can lead to unauthorized access and disclosure of sensitive files on the server. It is crucial to update to version 1.43.0 or later to mitigate this vulnerability. If immediate updating is not possible, implementing input validation and access controls can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for browserless-chrome →
FAQ
browserless-chrome is an npm package that provides a headless Chrome browser for programmatic interaction.
All versions of browserless-chrome prior to 1.43.0 are affected by this vulnerability.
This vulnerability allows an attacker to access arbitrary files on the server, potentially leading to unauthorized access and disclosure of sensitive information.
Updating browserless-chrome to version 1.43.0 or later will fix this vulnerability. Alternatively, implementing input validation and access controls can provide temporary mitigation.
Yes, a temporary workaround is to implement input validation and sanitization on the server-side, along with access controls to restrict file access.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
