CVE-2020-26282

BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Selenium tests. A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been patched in version 2.1.2.

• CWE-74

• https://github.com/browserup/browserup-proxy/commit/4b38e7a3e20917e5c3329d0d4e9590bed9d578abPatch, Third Party Advisory
• https://github.com/browserup/browserup-proxy/releases/tag/v2.1.2Third Party Advisory
• https://github.com/browserup/browserup-proxy/security/advisories/GHSA-wmfg-55f9-j8hqThird Party Advisory
• https://securitylab.github.com/research/bean-validation-RCEExploit, Third Party Advisory
• https://github.com/browserup/browserup-proxy/commit/4b38e7a3e20917e5c3329d0d4e9590bed9d578abPatch, Third Party Advisory
• https://github.com/browserup/browserup-proxy/releases/tag/v2.1.2Third Party Advisory
• https://github.com/browserup/browserup-proxy/security/advisories/GHSA-wmfg-55f9-j8hqThird Party Advisory
• https://securitylab.github.com/research/bean-validation-RCEExploit, Third Party Advisory

Published

Dec 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26277DBdeployer is a tool that deploys MySQL database servers eas…6.1
• CVE-2020-26278Weave Net is open source software which creates a virtual ne…8
• CVE-2020-26279go-ipfs is an open-source golang implementation of IPFS whic…8.1
• CVE-2020-2628Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26280OpenSlides is a free, Web-based presentation and assembly sy…8.9
• CVE-2020-26281async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates…7.5
• CVE-2020-26283go-ipfs is an open-source golang implementation of IPFS whic…8.8
• CVE-2020-26284Hugo is a fast and Flexible Static Site Generator built in G…8.5
• CVE-2020-26285OpenMage is a community-driven alternative to Magento CE. In…7.2
• CVE-2020-26286HedgeDoc is a collaborative platform for writing and sharing…7.5
• CVE-2020-26287HedgeDoc is a collaborative platform for writing and sharing…8.7
• CVE-2020-26288Parse Server is an open source backend that can be deployed …6.5