PT-2026-1558 · Microsoft · Playwright Mcp Server

Jonathan Leitschuh · Publicado 2026-01-07 · Atualizado 2026-01-07 · CVE-2025-9611

Positive Technologies (AI Summary)

CVSS v4.0

7.2

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Microsoft Playwright MCP Server versions prior to 0.0.40

Description The software does not properly validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server. This can lead to unintended invocation of MCP tool endpoints.

Recommendations Update to version 0.0.40 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-749

Identificadores relacionados

CVE-2025-9611

GHSA-6FG3-HVW7-2FWQ

GHSA-8RGW-6XP9-2FG3

Produtos afetados

Playwright Mcp Server

Referências · 12

• 🔥 https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-8rgw-6xp9-2fg3 · Exploit
• https://github.com/microsoft/playwright/commit/1313fbd · Correção
• https://github.com/microsoft/playwright-mcp · Nota
• https://github.com/microsoft/playwright-mcp/issues/1206 · Nota
• https://msrc.microsoft.com/report/vulnerability/VULN-164412 · Aviso do Fabricante
• https://vulncheck.com/advisories/microsoft-playwright-mcp-server-dns-rebinding-via-missing-origin-header-validation · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-9611 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-9611 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2008771281983070635 · Publicação no Twitter
• https://t.me/CVEtracker/41565 · Publicação no Telegram
• https://twitter.com/0dayPublishing/status/2008760731261387180 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-6fg3-hvw7-2fwq · Aviso do Fabricante