Executive brief
Microsoft Playwright MCP Server is a tool used by developers to integrate browser automation with AI-driven workflows. A security flaw in versions before 0.0.40 allows a malicious website to trick a user's browser into sending unauthorized commands to a locally running server. This could allow an attacker to remotely control the automation tools on a developer's machine, potentially leading to unauthorized data access or service disruption.
Technical details
The Microsoft Playwright MCP Server (@playwright/mcp) fails to validate the 'Origin' and 'Host' headers on incoming HTTP connections, violating the Model Context Protocol (MCP) security specification. This oversight allows a remote attacker to execute a DNS rebinding attack. By tricking a victim into visiting a malicious website or viewing a malicious advertisement, the attacker can use the victim's browser as a proxy to send unauthorized JSON-RPC requests to the MCP server running on localhost. This results in the unintended invocation of MCP tool endpoints. The vulnerability was addressed in version 0.0.40 by introducing host and origin validation.
Affected products
- Microsoft Playwright MCP Server (@playwright/mcp) < 0.0.40
Timeline
- 2025-09-23: patched: Fix committed to the Playwright repository.
- 2025-10-09: disclosed: Initial vulnerability report to Microsoft.
- 2025-11-17: advisory: Public disclosure by security researcher.
- 2026-01-07: disclosed: CVE-2025-9611 assigned and published.