Getting RCE on browser-use/web-ui AI Agent Instances

This report details a critical insecure-deserialization vulnerability in the browser-use/web-ui project: web-ui saves and loads settings with Python pickle, allowing an attacker-supplied .pkl file to execute arbitrary code server-side. The author demonstrates a PoC that exfiltrates environment variables and outlines an additional attack vector where disabled Chromium security flags let a malicious webpage upload a crafted pickle via an iframe, enabling compromise of both public and privately running instances; the report recommends switching to a safe serialization format (e.g., JSON) and notes the timeline of responsible disclosure and eventual patch.