CVE-2025-9611: 
JavaScript vulnerability analysis and mitigation

CVE-2025-9611 is a DNS rebinding vulnerability in the Microsoft Playwright MCP Server (@playwright/mcp) that allows an attacker to send unauthorized requests to a locally running MCP server by exploiting a victim's web browser. The vulnerability affects all versions prior to 0.0.40 of the @playwright/mcp npm package. It was originally discovered and reported on October 9, 2025, by security researcher Jonathan Leitschuh (JLLeitschuh), with public disclosure via GitHub Security Advisory GHSA-8rgw-6xp9-2fg3 on November 17, 2025, and CVE assignment by VulnCheck on January 7, 2026. The CVSS v4.0 base score is 7.2 (High) (GitHub Advisory, VulnCheck).

The root cause is a failure to validate the Origin or Host header on incoming HTTP connections to the MCP server, classified as CWE-749 (Exposed Dangerous Method or Function). This violates the MCP Base Protocol specification, which explicitly requires servers to validate the Origin header to prevent DNS rebinding attacks. An attacker can exploit this by luring a victim to a malicious website or serving a malicious advertisement; the browser is then used as a confused deputy to perform SSRF against the locally running MCP server (e.g., at http://127.0.0.1:8931). A simple curl command with a spoofed Origin: attacker.com header demonstrates the issue — the server responds with a valid MCP protocol response without rejecting the unauthorized origin. The fix, introduced in commit 1313fbd, adds an allowedHosts check that validates the Host header against a configurable allowlist, defaulting to the bound host (GitHub Advisory, Playwright Commit).

Successful exploitation allows an attacker to invoke any and all MCP tool endpoints on the victim's locally running Playwright MCP server without user approval, effectively giving the attacker full control over the server's browser automation capabilities. The impact includes low-level confidentiality compromise (e.g., reading browser state or accessible data), low-level integrity compromise (e.g., unauthorized browser actions), and high availability impact on the vulnerable system. Developers running the MCP server locally — a common configuration for AI-assisted coding workflows — are the primary at-risk population, and exploitation could lead to unauthorized web actions, data exfiltration via browser automation, or disruption of the MCP service (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been released, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.142%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Notably, Microsoft's MSRC declined to assign a CVE, stating the issue was already silently patched in v0.0.40; the CVE was ultimately assigned by VulnCheck following public disclosure by the researcher (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target developer running @playwright/mcp version 0.0.39 or earlier in HTTP/SSE mode (i.e., with --port flag set, exposing the server locally, typically on port 8931).
2. Lure the victim: Craft a malicious webpage or advertisement and deliver it to the victim via phishing or malvertising. The victim's browser must visit the attacker-controlled page.
3. DNS rebinding setup: Register a domain (e.g., attacker.com) and configure its DNS TTL to be very short. Initially resolve it to the attacker's server IP; after the victim loads the page, re-resolve the domain to 127.0.0.1 (the victim's localhost).
4. Browser-based SSRF: The malicious page's JavaScript makes a fetch/XHR request to http://attacker.com:8931/mcp. After DNS rebinding, the browser resolves this to 127.0.0.1:8931, bypassing the same-origin policy since the domain appears consistent to the browser.
5. Invoke MCP endpoints: Send crafted MCP JSON-RPC requests (e.g., initialize, tools/call) with the spoofed Origin: attacker.com header. The unpatched server accepts these without validation and responds with valid MCP protocol data.
6. Execute arbitrary tool calls: Use the MCP protocol to invoke any available tool (e.g., browser_navigate, browser_evaluate, browser_fill_form) to perform unauthorized browser automation actions on the victim's machine (GitHub Advisory, Playwright Commit).

• Network: Unexpected HTTP requests to http://127.0.0.1:<port>/mcp or http://localhost:<port>/mcp originating from browser processes; requests with Origin or Host headers set to external/unknown domains (e.g., Origin: attacker.com).
• Logs: MCP server access logs showing JSON-RPC initialize or tools/call requests from unexpected origins or hosts; repeated requests to MCP endpoints outside of normal developer tooling activity.
• Process: Unusual browser automation activity initiated by the Playwright MCP process (e.g., unexpected navigations, form submissions, or JavaScript evaluations not triggered by the developer); child processes spawned by the MCP server performing unexpected network or file operations.
• File System: Unexpected files written to the MCP output directory (--output-dir) that do not correspond to known developer sessions (GitHub Advisory).

The primary remediation is to upgrade @playwright/mcp to version 0.0.40 or later, which introduces Host header validation via an allowedHosts allowlist defaulting to the bound server host. The fix was implemented in commit 1313fbd and can be applied by running npm install @playwright/mcp@latest. As a configuration-based workaround for those who cannot immediately upgrade, restrict the MCP server to stdio transport (omit the --port flag) to avoid exposing an HTTP endpoint. If HTTP transport is required, use the --allowed-hosts CLI option or PLAYWRIGHT_MCP_ALLOWED_HOSTNAMES environment variable to explicitly restrict which hosts may connect, and consider network-level controls to block external access to the MCP server port (GitHub Advisory, Playwright Commit).

The disclosure generated notable commentary around Microsoft's handling of the CVE assignment process. Researcher Jonathan Leitschuh publicly criticized Microsoft's MSRC for refusing to assign a CVE on the grounds that the vulnerability had already been silently patched, calling the decision illogical and noting that retroactive CVE assignment is standard practice. The issue was subsequently raised in the public playwright-mcp GitHub repository (issue #1206) to increase visibility. The vulnerability was also highlighted in broader discussions about MCP server security, including a Telegraph article titled "One Day, Four Critical MCP CVEs: The January 23rd Wave," reflecting growing community concern about security in the emerging MCP ecosystem (GitHub Issue, GitHub Advisory).