https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 22:46:36 +0000 https://cve.radiocsirt.org/vuln/cve-2026-89039 <p><strong>Affected:</strong> Grafana mcp-k6</p> <p>A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user&#39;s home directory (path traversal). The working-directory restriction applied to &#39;@&#39;-prefixed paths can also be bypassed with a symbolic link inside the working directory that points outside it.</p> <p><strong>Affected:</strong> Grafana mcp-k6</p> <p>A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user&#39;s home directory (path traversal). The working-directory restriction applied to &#39;@&#39;-prefixed paths can also be bypassed with a symbolic link inside the working directory that points outside it.</p> https://cve.radiocsirt.org/vuln/cve-2026-89039