Unrated severityNVD Advisory· Published Jul 5, 2026· Updated Jul 6, 2026
zcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlink
CVE-2026-14699
Description
A weakness has been identified in zcaceres markdownify-mcp up to 1.1.0. The affected element is the function assertPathAllowed of the file src/Markdownify.ts. Executing a manipulation can lead to symlink following. The attack can only be executed locally. The pull request to fix this issue awaits acceptance.
Patches
Vulnerability mechanics
References
6- github.com/zcaceres/markdownify-mcp/pull/109mitreissue-trackingpatch
- vuldb.com/cve/CVE-2026-14699mitrethird-party-advisory
- vuldb.com/submit/846864mitrethird-party-advisory
- github.com/zcaceres/markdownify-mcp/issues/108mitreissue-tracking
- vuldb.com/vuln/376295mitrevdb-entrytechnical-description
- vuldb.com/vuln/376295/ctimitresignaturepermissions-required
News mentions
0No linked articles in our index yet.