CVE-2026-14699 Details
Description
A weakness has been identified in zcaceres markdownify-mcp up to 1.1.0. The affected element is the function assertPathAllowed of the file src/Markdownify.ts. Executing a manipulation can lead to symlink following. The attack can only be executed locally. The pull request to fix this issue awaits acceptance.
A vulnerability allowing symlink following has been identified in zcaceres markdownify-mcp versions through 1.1.0. The issue arises in the assertPathAllowed function within src/Markdownify.ts, where the path authorization check can be bypassed. When the MD_ALLOWED_PATHS or MD_SHARE_DIR variables are set, the server is supposed to reject paths outside the specified directories. However, the current check can be fooled by symlinked files, allowing access to files outside the allowed paths. This vulnerability can be exploited locally, and the pull request to address it is pending acceptance.
A pull request to fix this vulnerability by improving the path authorization checks is available but awaits acceptance.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 5, 2026CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zcaceres/markdownify-mcp/ | [email protected] | Source CodeVendor |
| https://github.com/zcaceres/markdownify-mcp/issues/108 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/zcaceres/markdownify-mcp/pull/109 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-14699 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/846864 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/376295 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/376295/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
| CWE-61 | UNIX Symbolic Link (Symlink) Following | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zcaceres markdownify-mcp | <= 1.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 5, 2026 | New CVE Received | [email protected] |