CVE-2026-55557 That1Drifter CVE debrief

Who should care

Defenders who manage MCP-capable agents and browse-mcp servers should assess their exposure and prioritize patching to prevent potential code execution. They should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, defenders should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed

Why it matters

CVE-2026-55557 is a high-severity vulnerability in the browse-mcp server that allows a malicious MCP client or an autonomous agent to write arbitrary file contents to any path the process can reach, potentially leading to host code execution. Defenders should prioritize verifying the version of browse-mcp and applying the patch to prevent potential code execution.

• Potential code execution on the host system.
• Arbitrary file contents can be written to any path the process can reach.
• Defenders should verify the version of browse-mcp and apply the patch to prevent potential code execution.

Technical summary

The vulnerability is caused by the lack of validation of the caller-controlled save_dir in the browser_download function, which allows an attacker to write arbitrary file contents to any path the process can reach, potentially leading to host code execution. The force_fetch fallback also uses a raw fetch() that bypasses the BROWSE_MCP_ALLOWED_ORIGINS origin fence. This issue is fixed in version 0.8.2. A malicious MCP client, or an autonomous agent steered by indirect prompt injection on a visited page, can choose an arbitrary save_dir or state path and a URL whose response body becomes attacker-controlled file contents, allowing writes to any path the process can reach, including ~/.bashrc, autostart entries,or

Defensive priority

Defenders should prioritize verifying the version of browse-mcp and applying the patch to prevent potential code execution.

Recommended defensive actions

• Verify the version of browse-mcp and apply the patch to prevent potential code execution.
• Restrict access to the browse-mcp server to only trusted MCP clients and agents.
• Monitor the browse-mcp server for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the lack of validation of the caller-controlled save_dir in the browser_download function, which allows an attacker to write arbitrary file contents to any path the process can reach.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.