Evidence · DiggingBeagle record
n8n Browser Use server-local file upload advisory
Security advisory distinguishing Playwright server file paths from a requesting user’s local files.
- Source role
- primary disclosure
Evidence record
Security advisory distinguishing Playwright server file paths from a requesting user’s local files.
Claim-level citations (2)
- supportsn8n Browser Use accepted server paths as user-approved upload files: The n8n Browser Use advisory ties the upload source to the n8n server filesystem, under an opt-in AI Browser Use feature, and identifies fixed releases for that configuration-dependent disclosure path.
GHSA-9qx8-fhxv-w794: browser_upload sourcePath, approval dialog, feature flag and fixed releases
- supportsn8n Browser Use accepted server paths as user-approved upload files: The browser_upload action interpreted a model-selected source path on the n8n server while the human approval described the outbound destination. The n8n AI Browser Use feature must be explicitly enabled and the agent must reach a file-upload step in its server-hosted Playwright session. An approved upload could transmit server-readable files rather than files belonging to the person requesting the task.
GHSA-9qx8-fhxv-w794: browser_upload sourcePath, approval dialog, feature flag and fixed releases