mirror of
https://github.com/browser-use/browser-use.git
synced 2026-09-14 19:59:47 +08:00
Saurav Panda
92defb6eae
GHSA-vfcm-843v-w6v3. `retry_with_browser_use_agent` defaulted `allowed_domains` to `[]` when the client omitted the argument, and then forwarded that value to `BrowserProfile(allowed_domains=[])`. `SecurityWatchdog` interprets the empty list as "no allowlist configured — allow every URL", silently disabling any admin-configured allowlist on the underlying profile. Default to `None` so admin profile defaults are preserved when the client omits the argument, and treat an explicit empty list the same as omitting (falsy override is not applied). Schema default removed and description updated so MCP clients see the new contract.