{"action":"Upgrade @playwright/mcp to 0.0.40 or later.","affected":[{"fixed":"0.0.40","introduced":"0"}],"component":"@playwright/mcp","cve_ids":["CVE-2025-9611"],"ecosystem":"npm","epss":0.01222,"exploited":false,"fixed_versions":["0.0.40"],"ghsa_id":"GHSA-6fg3-hvw7-2fwq","id":"tcs_01M5KF6TBBQDMPKGR6Q2YYT2EV","modified_at":"2026-02-03T03:16:20.816333Z","published_at":"2026-01-07T12:31:25Z","references":["https://osv.dev/vulnerability/GHSA-6fg3-hvw7-2fwq","https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-8rgw-6xp9-2fg3","https://nvd.nist.gov/vuln/detail/CVE-2025-9611","https://github.com/microsoft/playwright-mcp/issues/1206","https://github.com/microsoft/playwright/commit/1313fbd","https://github.com/microsoft/playwright-mcp","https://msrc.microsoft.com/report/vulnerability/VULN-164412","https://www.vulncheck.com/advisories/microsoft-playwright-mcp-server-dns-rebinding-via-missing-origin-header-validation"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-6fg3-hvw7-2fwq","url":"https://osv.dev/vulnerability/GHSA-6fg3-hvw7-2fwq"},{"source":"nvd","source_id":"CVE-2025-9611","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9611"}],"summary":"Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools"}