CVE-2025-9611
CVE-2025-9611 · Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Validation
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.
CVSS 7.2 · Alta · EPSS 1,2% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
playwright
- Versiones
- ≥ 0, < 0.0.40: Afectada (semver)
Actualiza a 0.0.40
@playwright/mcp npm
- Intervalos de versiones afectados
- SEMVER: < 0.0.40
Actualiza a 0.0.40
Fuentes originales
- https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-8rgw-6xp9-2fg3
- https://github.com/microsoft/playwright/commit/1313fbd
- https://www.vulncheck.com/advisories/microsoft-playwright-mcp-server-dns-rebinding-via-missing-origin-header-validation
- https://nvd.nist.gov/vuln/detail/CVE-2025-9611