Base Score

MEDIUM4

CVE-2025-47241

In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.

VectorNETWORK

Published Bycve@mitre.org

Published DateMay 03, 2025, 21:15

Affected Versions(1)

browser-use(PyPI)

Introduced0

Fixed0.1.45

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
browser-use(PyPI)	0	0.1.45	N/A

Weakness Type (CWE):CWE-647

CVSS Metrics

Base Score

Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Base Severity

MEDIUM

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

HIGH

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

NONE

Integrity (I)

LOW

Availability (A)

NONE

References

Base Score

MEDIUM4

Weakness Type (CWE):CWE-647

CVSS Metrics

Base Score

Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Base Severity

MEDIUM

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

HIGH

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

NONE

Integrity (I)

LOW

Availability (A)

NONE