Fast Playwright MCP Server

In the server's implementation (`lib/tools/evaluate.js:85`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const value = eval(`(${source})`); const isFunction = typeof value === "function"; const r

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server lib/tools/evaluate.js

In the server's implementation (`lib/extension/cdp-relay.js:21`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; import { platform } from "node:os"; import { isAbsolute } from "node:path"; impo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server lib/extension/cdp-relay.js

In the server's implementation (`lib/browser-server-backend.js:109`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ration = this._registry.require(name); const effect = registration.tool.schema.type; if (expected === "readOnly"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server lib/browser-server-backend.js

In the server's implementation (`lib/tools/catalog/gateways.js:97`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ema: toMcpTool(registry.require(item.name).tool.schema).inputSchema } : {} })); return r

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server lib/tools/catalog/gateways.js

In the server's implementation (`lib/tools/catalog/registry.js:125`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: byName.get(name); } require(name) { const registration = this.get(name); if (!registration) { throw ne

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server lib/tools/catalog/registry.js

In the server's implementation (`lib/tools/catalog/visibility.js:58`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: names) { registry.require(name); } const before = this.enabled.size; for (const name of names) {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server lib/tools/catalog/visibility.js

In a packaging/dev/install script (shipped, but not the server runtime) (`lib/tools/install.js:21`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ort { fork } from "node:child_process"; import path from "node:path"; import { fileURLToPath } from "node:url"; import {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server lib/tools/install.js