Playwright (leviathangk) MCP Server

Tool "browser_execute_script" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool browser_execute_script

In the server's implementation (`build/tools/execute-script.js:31`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const func = new Function('args', ` return (function() { ${script} }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/tools/execute-script.js

In the server's implementation (`build/tools/install-browser.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { exec } from 'child_process'; import { promisify } from 'util'; const execAsync = promisify(exec); export asyn

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/tools/install-browser.js

Untrusted-input tools ([browser_get_page_structure, browser_get_page_content]) co-exist with external-action tools ([browser_execute_script]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [browser_get_page_structure, browser_get_page_content] → sinks [browser_execute_script]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow browser_get_page_structure → browser_execute_script

Tool "browser_execute_script" takes a command-shaped parameter "script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool browser_execute_script · inputSchema.properties.script

Tool "browser_execute_script" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool browser_execute_script