Summary
In CLI v1.1.0 the long-lived command_daemon is spawned with an environment
variable KEY=VALUE string as the value of --data-dir, instead of a
directory path. Any secret present in the shell environment can therefore end
up in plaintext in the daemon's argv, readable by every local process via
ps.
Environment
- CLI:
browser-act-cli 1.1.0 (installed via uv tool install)
- Python: 3.12
- OS: macOS 25.1.0 (Apple Silicon)
- Previous version 1.0.1 on the same machine was not affected — it had no daemon.
Reproduction
- Ensure some variable is exported in the shell, e.g.
export MY_TOKEN=sk-example.
- Run any command that spawns the daemon, e.g.
browser-act browser list.
- Inspect the process table:
Actual result
python3 -m browser_act_cli.command_daemon --cli-version 1.1.0 \
--data-dir AGENT_ROUTER_TOKEN=sk-<redacted>
The behaviour is deterministic rather than random. After unsetting that
variable and re-running the exact same command, the daemon picked up a
different environment entry at the same position:
python3 -m browser_act_cli.command_daemon --cli-version 1.1.0 \
--data-dir AIHUBMIX_API_KEY=<redacted>
Expected result
--data-dir should receive the CLI data directory path, and no environment
entry should ever be placed into argv.
Impact
- Any secret exported in the user's shell (API keys, agent tokens, CI
credentials) may be exposed in plaintext to any local process that can run ps.
- Because the daemon is long-lived, the exposure is continuous rather than
momentary — unlike a short-lived subprocess.
- Agent hosts such as Cursor, Claude Code, and CI runners routinely inject
tokens into the environment, so this is likely to hit real secrets in
practice.
Likely cause
The environment mapping and the argument list appear to be concatenated or
indexed incorrectly when building the Popen call for the daemon.
Worth noting that --data-dir is evidently not honored at all: commands keep
working normally despite receiving this garbage value, which suggests the
argument is parsed and then discarded.
Suggested fix
Pass the environment via the env= parameter of Popen and keep argv
limited to real CLI arguments; additionally validate that --data-dir is an
existing path before accepting it.
Summary
In CLI v1.1.0 the long-lived
command_daemonis spawned with an environmentvariable
KEY=VALUEstring as the value of--data-dir, instead of adirectory path. Any secret present in the shell environment can therefore end
up in plaintext in the daemon's
argv, readable by every local process viaps.Environment
browser-act-cli1.1.0 (installed viauv tool install)Reproduction
export MY_TOKEN=sk-example.browser-act browser list.Actual result
The behaviour is deterministic rather than random. After unsetting that
variable and re-running the exact same command, the daemon picked up a
different environment entry at the same position:
Expected result
--data-dirshould receive the CLI data directory path, and no environmententry should ever be placed into
argv.Impact
credentials) may be exposed in plaintext to any local process that can run
ps.momentary — unlike a short-lived subprocess.
tokens into the environment, so this is likely to hit real secrets in
practice.
Likely cause
The environment mapping and the argument list appear to be concatenated or
indexed incorrectly when building the
Popencall for the daemon.Worth noting that
--data-diris evidently not honored at all: commands keepworking normally despite receiving this garbage value, which suggests the
argument is parsed and then discarded.
Suggested fix
Pass the environment via the
env=parameter ofPopenand keepargvlimited to real CLI arguments; additionally validate that
--data-diris anexisting path before accepting it.