PT-2026-6379 · Npm · @Playwright/Mcp

Publicado 2026-01-07 · Atualizado 2026-01-07

OSV

CVSS v4.0

7.2

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L

Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.

Correção

Enumeração de Fraquezas

CWE-749

Identificadores relacionados

GHSA-6FG3-HVW7-2FWQ

Produtos afetados

@Playwright/Mcp

Referências · 8

• https://github.com/microsoft/playwright/commit/1313fbd · Nota
• https://github.com/microsoft/playwright-mcp · Nota
• https://github.com/microsoft/playwright-mcp/issues/1206 · Nota
• https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-8rgw-6xp9-2fg3 · Nota
• https://msrc.microsoft.com/report/vulnerability/VULN-164412 · Aviso do Fabricante
• https://vulncheck.com/advisories/microsoft-playwright-mcp-server-dns-rebinding-via-missing-origin-header-validation · Nota
• https://osv.dev/vulnerability/GHSA-6fg3-hvw7-2fwq · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-9611 · Nota de Segurança