mcp-k6 vulnerabilities

CVEs whose affected-version data names the mcp-k6 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-89039Medium· 6.5

3w ago

A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud…

A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud…

▾ SunlitGrafana · mcp-k6EPSS 0.38%via NVD