GHSA-f54f-hr32-586f: Duplicate Advisory: `allowed_domains` can be bypassed by putting a decoy domain in http auth username portion of a URL
This advisory was withdrawn on May 5, 2025. The publisher no longer considers it a valid vulnerability.
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x39x-9qw5-ghrf. This link is maintained to preserve external references. Original Description In browser-use (aka Browser Use) before 0.1.45, URL parsing of alloweddomains is mishandled because userinfo can be placed in the authority component.
Published May 3, 2025 · Updated May 5, 2025
Affected packages
browser-use
- Ecosystem
- PyPI
- Affected
- <= 0.1.44
- Fixed in
- 0.1.45
- Check
pip show browser-use
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-x39x-9qw5-ghrf. This link is maintained to preserve external references.
Original Description
In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology