The convert_playwright_script prompt in Grafana’s k6 MCP server allows a caller to provide an arbitrary file path as the playwright_script argument. When a bare path is supplied, the server bypasses its intended working‑directory checks and reads the file, returning its contents to the caller. This permits the disclosure of any file readable by the server process, including sensitive data such as SSH keys or cloud credentials residing in the process owner’s home directory. Additionally, the enforcement of the working‑directory restriction for ‘@’-prefixed paths can be circumvented by creating a symbolic link inside the working directory that points outside it.

This vulnerability affects Grafana’s k6 MCP (mcp‑k6) component. All installed releases of the component remain susceptible until the vendor releases a patch that restores proper path restrictions and input validation. The flaw resides specifically in the convert_playwright_script prompt handling within the MCP server.

The CVSS score of 6.5 indicates moderate severity. No EPSS data is available, and the issue is not listed in CISA’s KEV catalog, implying it is not a known, actively exploited vulnerability. However, the vulnerability is exploitable by any user who can invoke the convert_playwright_script prompt through the MCP API or interface, which may be remote or local depending on network exposure. Exploitation requires only the ability to supply a file path; once the prompt is invoked, the server reads and returns the file contents without performing further authorization checks.