CVE-2025-9611
1 advisory.
npm/@playwright/mcp CVE-2025-9611: high, EPSS 1.22%
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools
Action: Upgrade @playwright/mcp to 0.0.40 or later.
npm i @playwright/mcp@0.0.40Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.0.40 | - |
Fixed versions
| 0.0.40 |
Sources
- osv: GHSA-6fg3-hvw7-2fwq
- https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-8rgw-6xp9-2fg3
- https://nvd.nist.gov/vuln/detail/CVE-2025-9611
- https://github.com/microsoft/playwright-mcp/issues/1206
- https://github.com/microsoft/playwright/commit/1313fbd
- https://github.com/microsoft/playwright-mcp
- https://msrc.microsoft.com/report/vulnerability/VULN-164412
- https://www.vulncheck.com/advisories/microsoft-playwright-mcp-server-dns-rebinding-via-missing-origin-header-validation
CVE-2025-9611 · published · modified · JSON