Remote Code Execution (RCE) in pptr-mcp via execute Tool

Vulnerability Overview Vulnerability Name: Remote Code Execution via execute Tool in pptr-mcp Vulnerability ID: #1 Vulnerability Type: Remote Code Execution (RCE) Vulnerability Description: exposes an MCP tool named , which accepts a user-supplied JavaScript string and executes it on the MCP server host. Although the code runs within a Node.js VM sandbox, the sandbox is explicitly designed as a convenience layer rather than a security boundary. Furthermore, the tool grants full access to the active Puppeteer browser instance. Using MCP Inspector to connect to a locally built server instance confirmed three attack primitives: 1. Arbitrary JavaScript execution in the server process. 2. Unrestricted browser navigation and page content extraction (any URL accessible via Chrome). 3. Local file system reading via the protocol. Impact Scope Affected Components: Entry Point: registers the tool, accepting a free-form parameter without authentication, authorization, or input sanitization. Execution Path: in wraps the provided string and evaluates it via . Root Cause Analysis: 1. Unrestricted Code Execution is Core Functionality: The tool accepts any JavaScript string and executes it on the server side. 2. Node.js VM Sandbox is Not a Security Boundary: The project README explicitly states that the Node.js VM sandbox is intended for convenience, not for security isolation. 3. Full Puppeteer Browser Access Leads to Host-Adjacent Attacks: Passing the global variable into the VM execution context allows attackers to leverage the complete Puppeteer API. 4. No MCP Layer Access Control: The server communicates via stdin, lacking authentication, session binding, or tool-level authorization. 5. Persistent Browser Sessions Amplify Impact: Using (default), cookies, local storage, and login sessions persist across tool calls. Remediation Recommendations: 1. Treat as a privileged local tool: Connect only from trusted MCP clients in single-user development environments. 2. Never expose the MCP server to untrusted networks: Or run it as a shared service with strict controls. 3. Use : Prevent state persistence between isolated calls. 4. Avoid configuring the server to serve tools to sensitive web applications during authentication: Persistent profiles retain session state. Hardening Suggestions for Upstream Maintainers: 1. Replace free-form code execution with fixed parameterized operations: Such as navigation, clicking, screenshotting, etc. 2. If programmatic flexibility must be retained: Run untrusted code in dedicated OS-level sandboxes (VMs, containers with seccomp/AppArmor/gVisor) rather than using . 3. Enable the Chrome sandbox where supported by the deployment environment: Document trade-offs explicitly. 4. Add optional authentication or tool-level authorization at the MCP transport layer. 5. Disable or restrict navigation: Use Chrome launch flags (e.g., if applicable) or custom URL blocking. 6. Highlight the RCE classification in the README and MCP registry: To enable consumers to make informed risk acceptance decisions. POC Code PoC 1 — Arbitrary JavaScript Execution PoC 2 — Unrestricted Browser Navigation and Page Content Exfiltration PoC 3 — Local File System Reading via Note: Adjust paths according to the operating system. On Linux/macOS, for example, .

Goal Reached Thanks to every supporter — we hit 100%!

Remote Code Execution (RCE) in pptr-mcp via execute Tool

More from this source