dsh-browser-ops

/plugins/dsh-browser-ops/action accepts any JSON body and dispatches launch/connect, openUrl, record*, flowEdit, flowDelete and runFlow; /state returns status, flow list and the local dataDir. The handlers never check method, token, Origin, Referer or Host. Any local process, or any web page the user's browser loads, can POST to the loopback server (a text/plain body is a CORS simple request, so no preflight blocks it; DNS rebinding can additionally make responses readable). Effects: launching/attaching a real Chrome, opening attacker-chosen URLs, replaying stored flows, and reading recorded f

idOrName comes straight from HTTP payload.flowId (flowGet/flowDelete/flowEdit/runFlow) and from the browser_flow_* tools, and is joined without normalisation, so '../../../../somewhere/config' resolves to <that path>.json: any JSON file on the machine can be probed and partially parsed. If the traversed file parses to a flow object, runFlow executes its steps (including the 'evaluate' step type, which runs page scripts, and navigate/openTab to arbitrary or file:// URLs), and saveFlow/deleteFlow build their target from that object's id field, so a file whose id contains traversal can cause a wr

browser_eval tool input (and, in lib/core/replay.js line 156, a persisted '{type:"evaluate"}' flow step executed via page.evaluate(`(${step.expression})()`)) is turned into code. The constructed function is only serialised by Playwright and evaluated inside the page, not in Node, so this is page-context JS execution — equivalent to the intended browser_eval capability, but it means a manipulated agent or a flow file planted outside the data dir (see the traversal finding) can run arbitrary script in the attached Chrome profile, including the user's daily profile in connect mode.

The audited set contains only 15 files, yet the entry path imports modules that are absent from it: ./tools.js (lib/index.js line 6, lib/http.js line 7), ./core/bridge.js and ./core/record.js (lib/core/factory.js lines 4-5) and ./client.js (declared in package.json exports). Those files hold the Chrome launch arguments, CDP attach logic, page-script injection (DRAIN_SRC) and the browser_eval tool wrapper — exactly where a backdoor or unsafe spawn would live — so the pass/warn judgement here cannot cover them.