PatchTheCVE: pinchtabhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2026-33623: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browserhttps://patchthecve.com/cve/CVE-2026-33623.htmlhttps://patchthecve.com/cve/CVE-2026-33623.htmlWed, 17 Jun 2026 10:37:48 +0000MEDIUM 6.7: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.4` contains a Windows-only command injection issue in the orphaned Chrome cleanup path. When an instance is stopped, the Windows cleanup routine builds a PowerShell `-Command` string using CVE-2026-33622: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browserhttps://patchthecve.com/cve/CVE-2026-33622.htmlhttps://patchthecve.com/cve/CVE-2026-33622.htmlWed, 17 Jun 2026 10:37:48 +0000HIGH 8.8: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.3` through `v0.8.5` allow arbitrary JavaScript execution through `POST /wait` and `POST /tabs/{id}/wait` when the request uses `fn` mode, even if `security.allowEvaluate` is disabled. `POSTCVE-2026-33621: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browserhttps://patchthecve.com/cve/CVE-2026-33621.htmlhttps://patchthecve.com/cve/CVE-2026-33621.htmlWed, 17 Jun 2026 10:37:48 +0000MEDIUM 4.8: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.7.7` through `v0.8.4` contain incomplete request-throttling protections for auth-checkable endpoints. In `v0.7.7` through `v0.8.3`, a fully implemented `RateLimitMiddleware` existed in `interCVE-2026-33620: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browserhttps://patchthecve.com/cve/CVE-2026-33620.htmlhttps://patchthecve.com/cve/CVE-2026-33620.htmlWed, 17 Jun 2026 10:37:47 +0000MEDIUM 4.3: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.7.8` through `v0.8.3` accepted the API token from a `token` URL query parameter in addition to the `Authorization` header. When a valid API credential is sent in the URL, it can be exposed thCVE-2026-33619: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browserhttps://patchthecve.com/cve/CVE-2026-33619.htmlhttps://patchthecve.com/cve/CVE-2026-33619.htmlWed, 17 Jun 2026 10:37:47 +0000MEDIUM 4.1: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 contains a server-side request forgery issue in the optional scheduler's webhook delivery path. When a task is submitted to `POST /tasks` with a user-controlled `callbackUrl`, the v0.8.3 sCVE-2026-33081: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browserhttps://patchthecve.com/cve/CVE-2026-33081.htmlhttps://patchthecve.com/cve/CVE-2026-33081.htmlWed, 17 Jun 2026 10:36:55 +0000MEDIUM 5.8: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Versions 0.8.2 and below have a Blind SSRF vulnerability in the /download endpoint. The validateDownloadURL() function only checks the initial user-supplied URL, but the embedded Chromium browser can follCVE-2026-30834: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browserhttps://patchthecve.com/cve/CVE-2026-30834.htmlhttps://patchthecve.com/cve/CVE-2026-30834.htmlWed, 17 Jun 2026 10:32:59 +0000HIGH 7.5: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7, a Server-Side Request Forgery (SSRF) vulnerability in the /download endpoint allows any user with API access to induce the PinchTab server to make requests to arbitrary URLs, inclu