Pinchtab vulnerabilities
We track 3 vulnerabilities in Pinchtab products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on March 26, 2026.
Latest Pinchtab vulnerabilities
- 7.2 High severity
pinchtab: Improper Neutralization of Special Elements used in an OS Command
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.4` contains a Windows-only command injection issue in the orphaned Chrome cleanup path. When an instance is stopped, the Windows cleanup routine buil
- 8.8 High severity
pinchtab: Improper Control of Generation of Code
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.3` through `v0.8.5` allow arbitrary JavaScript execution through `POST /wait` and `POST /tabs/{id}/wait` when the request uses `fn` mode, even if `se
- 7.5 High severity
pinchtab: Server-Side Request Forgery
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7, a Server-Side Request Forgery (SSRF) vulnerability in the /download endpoint allows any user with API access to induce the PinchTab server t