mcp-playwright

executeautomation/mcp-playwright

This MCP server lets an AI agent automate web browsers (Chromium, Firefox, and WebKit), make HTTP API requests, take screenshots, and generate Playwright test files. Because tool arguments are not restricted by URL scheme or file path, a prompt injection on a visited webpage can cause the agent to read or upload arbitrary local files, make requests to internal network services, or inject code into generated test scripts.

What it can reach

Browser

Launches and controls Chromium, Firefox, and WebKit browsers, navigates to URLs, clicks and fills elements, reads page HTML and console logs, and executes arbitrary JavaScript inside pages.

Network

Makes arbitrary HTTP GET, POST, PUT, PATCH, and DELETE requests, navigates to any URL, and optionally listens on local HTTP ports for MCP SSE connections and health/metrics endpoints.

Files

Reads local files for browser file uploads, writes screenshots, PDFs, and generated Playwright test files (.spec.ts) to caller-specified paths, and writes logs to ~/playwright-mcp-server.log.

Shell commands

Spawns npx playwright install <browserType> to automatically download and install missing browser binaries at runtime.

Findings

1. HighUnrestricted URL navigation and HTTP requests allow local file reading and SSRF

   src/tools/browser/navigation.ts:31

   The playwright_navigate tool passes the url argument directly to page.goto() without checking the URL scheme or target host. If an agent reads untrusted content containing a prompt injection, an attacker can direct the browser to file:// URLs (such as file:///etc/passwd or SSH keys) or internal network addresses (such as localhost or cloud metadata services) and read the result with playwright_get_visible_text. The API tools (playwright_get, playwright_post, playwright_put, playwright_patch, playwright_delete) similarly allow unrestricted requests to internal hosts.

   Fix: Validate all URLs before navigation or API requests to allow only http: and https: schemes, and block requests to private IP ranges, loopback addresses, and link-local metadata endpoints unless explicitly configured by the user.

2. HighUnrestricted local file upload in playwright_upload_file allows file exfiltration

   src/tools/browser/interaction.ts:146

   The playwright_upload_file tool accepts any absolute filePath and attaches that file to a page's file input element without checking whether the file is within an allowed workspace directory. Through prompt injection, a malicious webpage can instruct the agent to upload sensitive local files (such as ~/.ssh/id_rsa, ~/.aws/credentials, or .env files) directly to an attacker-controlled server.

   Fix: Restrict filePath to an explicit, user-configured allowlist directory and reject paths that resolve outside that directory or point to symlinks.

3. HighCode injection in generated Playwright test files

   src/tools/codegen/generator.ts:96

   During a code generation session, PlaywrightGenerator builds a .spec.ts file by interpolating tool arguments (url, selector, value, userAgent, and id) directly into JavaScript code strings without escaping. Furthermore, start_codegen_session accepts any outputPath on disk. If untrusted input (for example from a prompt injection) is recorded during a session, single quotes in those arguments break out of the string literal and inject arbitrary JavaScript/TypeScript code that will run on the user's machine when the generated test is executed.

   Fix: Serialize all interpolated values with JSON.stringify() instead of wrapping raw strings in single quotes, validate that response IDs are strict alphanumeric identifiers, and restrict outputPath to the project workspace.

4. MediumUnrestricted file paths in screenshot and PDF tools allow writing to arbitrary directories

   src/tools/browser/screenshot.ts:49

   ScreenshotTool always writes a PNG file to disk (even when savePng is omitted) and builds the file path from args.downloadsDir and args.name without preventing path traversal (../) or restricting the target directory. SaveAsPdfTool in src/tools/browser/output.ts similarly resolves args.outputPath and args.filename directly. An attacker using prompt injection can create directories and write PNG or PDF files anywhere the user account has write permissions.

   Fix: Sanitize filenames with path.basename(), restrict output directories to a safe default folder, and only write screenshots to disk when savePng is explicitly true.

5. MediumHTTP mode lacks authentication, shares browser state across sessions, and binds monitoring to all interfaces

   src/monitoring/system.ts:190

   When the server is started with --port, the HTTP MCP endpoints in src/http-server.ts require no authentication token or Origin/Host header check, and all connected clients share the same global browser and page variables in src/toolHandler.ts rather than isolating sessions. In addition, the monitoring HTTP server in src/monitoring/system.ts calls listen(port) without specifying 127.0.0.1, exposing /health, /metrics, and /ready on all network interfaces (0.0.0.0).

   Fix: Bind the monitoring server explicitly to 127.0.0.1, require a bearer token and strict Host/Origin validation in HTTP mode, and maintain separate browser contexts per session.

6. MediumBearer tokens, custom headers, and form values are logged in plaintext due to mismatched field names

   src/logging/middleware.ts:223

   RequestLoggingMiddleware.sanitizeToolArgs attempts to redact secrets before writing logs to ~/playwright-mcp-server.log (or /tmp/playwright-mcp-server.log), but checks the wrong argument names. It checks sanitized.body instead of sanitized.value for API requests, checks sanitized.text instead of sanitized.value for playwright_fill, and does not redact sanitized.token or sanitized.headers. As a result, Bearer tokens, Authorization headers, and passwords typed into forms are written in plaintext to the log file.

   Fix: Update sanitizeToolArgs to redact args.token, sensitive keys in args.headers, and args.value in playwright_fill, playwright_iframe_fill, and API request tools, and create log files with 0600 permissions.