Description
browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
browser-use web-ui
Default version status: unaffected
2.0.0 to ≤ 3.0.0affected
pkg:github/browser-use/web-ui