github.com/pinchtab/pinchtab/cmd/pinchtab

3 results · Feed

• Medium 6.7
  CVE-2026-33623

  PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution

  PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.4` contains a Windows-only command injection issue in the orphaned Chrome cleanup path. When an instance is stopped, the Windows cleanup routine bui…

  pinchtab pinchtab github.com/pinchtab/pinchtab github.com/pinchtab/pinchtab/cmd/pinchtab Go
  Mar 26, 2026
• Medium 6.1
  CVE-2026-33622

  A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution

  PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.3` through `v0.8.5` allow arbitrary JavaScript execution through `POST /wait` and `POST /tabs/{id}/wait` when the request uses `fn` mode, even if `s…

  pinchtab pinchtab github.com/pinchtab/pinchtab github.com/pinchtab/pinchtab/cmd/pinchtab Go
  Mar 26, 2026
• High 7.5
  CVE-2026-30834

  PinchTab: SSRF with Full Response Exfiltration via Download Handler

  PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7, a Server-Side Request Forgery (SSRF) vulnerability in the /download endpoint allows any user with API access to induce the PinchTab server …

  pinchtab pinchtab github.com/pinchtab/pinchtab github.com/pinchtab/pinchtab/cmd/pinchtab Go
  Mar 7, 2026