Disclosed weakness · no CVE recorded

Archived Puppeteer MCP server can turn browsing permission into command execution

Model Context Protocol reference servers · Deprecated @modelcontextprotocol/server-puppeteer

First documented disclosure · Review checkpoint

Summary

Glow reports prompt-injection-driven command execution in the abandoned browser server.

Severity and exploitation evidence

High · numeric CVSS score not recorded. Severity source.

Exploitation not established: Researcher finding; Glow reports no observed malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Agent-controlled launch settings can start another process instead of a browser.

Conditions required

The deprecated server is enabled and the agent follows malicious instructions with browsing permission.

Potential impact

Commands can run with the local server’s authority.

Affected versions and configurations

Exact affected version range not published.

Fix and mitigation status

No fix planned in the archived repository.

Practical next steps

Remove deprecated server configurations; select maintained replacements and check publisher and deprecation status before installation.

Operating lesson

Browsing permission must not authorize arbitrary process launch.

Evidence and limits

Glow’s header and index say November 2; another byline and structured metadata say November 3. Earlier dates describe private reporting. No CVE or CVSS score is published; High is Glow’s qualitative label. Three additional claimed flaws lack enough detail for separate records. Observed installations are not compromises.

Sources