AgentDeskAI browser-tools-mcp fino a 1.2.0 browser-connector.ts escalationi di privilegi

I believe the current handling and attribution of this vulnerability are incorrect and should be formally reviewed and corrected.

I reported this vulnerability to the official project on GitHub on [March 14](https://github.com/AgentDeskAI/browser-tools-mcp/issues/224#issue-4074839737). The other applicant submitted their report later, on [April 7](https://github.com/AgentDeskAI/browser-tools-mcp/issues/232#issue-4216522955).

More importantly, this is not merely a matter of comparing submission dates. The project maintainer explicitly confirmed that the later report was a duplicate of my earlier report. In response to Issue #232, the maintainer stated:

> “Fixed in 2.0.0, and thank you for the writeup. Duplicate of #224, tracking there. On your CVE request: a GitHub Security Advisory is now published at GHSA-xvrv-w8pg-f25f and a CVE has been requested through it — I will post the identifier here once assigned. Details of the fix are in #224 and in SECURITY.md.”

This statement is unambiguous: Issue #232 was considered a duplicate of my Issue #224, and the vulnerability was being tracked through my earlier report.

The corresponding GitHub Security Advisory is also available here:

[GHSA-xvrv-w8pg-f25f](https://github.com/AgentDeskAI/browser-tools-mcp/security/advisories/GHSA-xvrv-w8pg-f25f)

In addition, the project maintainer formally credited me on GitHub for the original vulnerability disclosure.

Given this evidence, I do not believe it is reasonable to attribute the vulnerability to the later applicant, or to treat the two reports as if they had equal priority. The project maintainer has already established the reporting history and explicitly identified the later submission as a duplicate.

I therefore request that you review the attribution for this vulnerability and correct the reporter credit accordingly.

Please verify the following evidence directly:

1. My original report, Issue #224, was submitted on March 14.
2. Issue #232 was submitted later, on April 7.
3. The project maintainer explicitly stated that Issue #232 is a “Duplicate of #224.”
4. The maintainer stated that the fix details are tracked in Issue #224 and SECURITY.md.
5. The related GitHub Security Advisory is GHSA-xvrv-w8pg-f25f.
6. I was formally credited by the project maintainer for the original disclosure.

Based on the project's own public record, the reporting priority is clear. I therefore ask that the current attribution be corrected to reflect the original report and the maintainer's documented determination.

Thank you for reviewing and correcting this matter.