Playwright CVEs and Security Vulnerabilities

CVE-2025-9611

Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Validation

Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.

CVSS 4.0 · 7.2 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Playwright

CVE-2025-59288

Playwright Spoofing Vulnerability

Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Github Microsoft

Products

Github Azure Playwright Playwright

Search vulnerabilities

Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Validation

Playwright Spoofing Vulnerability