CVE-2026-89039 — A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playw…
A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including …
CVSS 6.5