Recommended action

Update cloakbrowser to 0.3.28 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion affects cloakbrowser (pip). Severity is high. The `cloakserve` CDP multiplexer uses the user-supplied `fingerprint` query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted `fingerprint` value containing path traversal sequences to resolve `user_data_dir` outside the configured `data_dir`. When Chrome fails to start or the process is cleaned up, `shutil.rmtree()` deletes the traversed path, resulting in arbitrary directory deletion. Additionally, `cloakserve` bound to `0.0.0.0` by default, making it network-exposed. ### Impact An attacker with network access to the cloakserve port can delete arbitrary directories accessible to the service user. ### Patches Fixed in v0.3.28. ### Mitigations - Upgrade to v0.3.28 or later - Restrict network access to the cloakserve port

AI coding agents often install or upgrade packages automatically in pip. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update cloakbrowser to 0.3.28 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion affects cloakbrowser (pip). Severity is high. The `cloakserve` CDP multiplexer uses the user-supplied `fingerprint` query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted `fingerprint` value containing path traversal sequences to resolve `user_data_dir` outside the configured `data_dir`. When Chrome fails to start or the process is cleaned up, `shutil.rmtree()` deletes the traversed path, resulting in arbitrary directory deletion. Additionally, `cloakserve` bound to `0.0.0.0` by default, making it network-exposed. ### Impact An attacker with network access to the cloakserve port can delete arbitrary directories accessible to the service user. ### Patches Fixed in v0.3.28. ### Mitigations - Upgrade to v0.3.28 or later - Restrict network access to the cloakserve port

AI coding agents often install or upgrade packages automatically in pip. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software