Playwright vulnerabilities
CVEs whose affected-version data names the Playwright package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2025-9611High· 7.2PoCMicrosoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to …
▾ MidnightMicrosoft · PlaywrightEPSS 1.2%via NVD
CVE-2025-59288Medium· 5.3Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.
Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.
▾ Sunlitmicrosoft · playwrightEPSS 0.23%via NVD