CVE-2025-9611
CVE-2025-9611 · Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Validation
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.
CVSS 7.2 · Élevée · EPSS 1,2% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
playwright
- Versions du logiciel
- ≥ 0, < 0.0.40: Concernée (semver)
Mettez à jour vers 0.0.40
@playwright/mcp npm
- Plages de versions concernées
- SEMVER: < 0.0.40
Mettez à jour vers 0.0.40
Sources originales
- https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-8rgw-6xp9-2fg3
- https://github.com/microsoft/playwright/commit/1313fbd
- https://www.vulncheck.com/advisories/microsoft-playwright-mcp-server-dns-rebinding-via-missing-origin-header-validation
- https://nvd.nist.gov/vuln/detail/CVE-2025-9611