CVE-2026-33622

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33622
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33622.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33622
Aliases
Downstream
Related
Published
2026-03-26T20:44:48.220Z
Modified
2026-04-02T13:27:53.594914Z
Severity
  • 6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution
Details

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 through v0.8.5 allow arbitrary JavaScript execution through POST /wait and POST /tabs/{id}/wait when the request uses fn mode, even if security.allowEvaluate is disabled. POST /evaluate correctly enforces the security.allowEvaluate guard, which is disabled by default. However, in the affected releases, POST /wait accepted a user-controlled fn expression, embedded it directly into executable JavaScript, and evaluated it in the browser context without checking the same policy. This is a security-policy bypass rather than a separate authentication bypass. Exploitation still requires authenticated API access, but a caller with the server token can execute arbitrary JavaScript in a tab context even when the operator explicitly disabled JavaScript evaluation. The current worktree fixes this by applying the same policy boundary to fn mode in /wait that already exists on /evaluate, while preserving the non-code wait modes. As of time of publication, a patched version is not yet available.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33622.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284",
        "CWE-693",
        "CWE-94"
    ]
}
References

Affected packages

Git / github.com/pinchtab/pinchtab

Affected ranges

Type
GIT
Repo
https://github.com/pinchtab/pinchtab
Events
Introduced
e0c3e5748c1c3a1a0cab7790872bf0b3ec648bb4
Last affected
ce7efa1c3d564cafcf094fcdbd22ffdd7863e71d
Database specific 
{
    "versions": [
        {
            "introduced": "0.8.3"
        },
        {
            "last_affected": "0.8.5"
        }
    ]
}

Affected versions

v0.*
v0.8.3
v0.8.4
v0.8.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33622.json"