CVE-2025-47241

Summary

In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.

Affected Software

Weaknesses

• CWE-647: CWE-647 Use of Non-Canonical URL Paths for Authorization Decisions

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/browser-use/browser-use/security/advisories/GHSA-x39x-9qw5-ghrf
• https://github.com/browser-use/browser-use/releases/tag/0.1.45
• https://github.com/browser-use/browser-use/pull/1561

• ←Previous
• Next→