CVE-2026-14699
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A vulnerability has been discovered in zcaceres markdownify-mcp up to version 1.1.0, allowing symlink following via the assertPathAllowed function in src/Markdownify.ts. The attack can only be executed locally.
Risk Assessment
An attacker with local access could exploit this vulnerability to read or write files outside the intended directory, potentially compromising data confidentiality or integrity.
Recommendation
Update the library to the latest version once the fix is released, or apply a temporary workaround such as restricting application access to trusted users only.
Original NVD description (English source)
A weakness has been identified in zcaceres markdownify-mcp up to 1.1.0. The affected element is the function assertPathAllowed of the file src/Markdownify.ts. Executing a manipulation can lead to symlink following. The attack can only be executed locally. The pull request to fix this issue awaits acceptance.