Is there a patch available for CVE-2026-14699?

Yes, a patch is available for CVE-2026-14699. Update the affected software to the latest version immediately.

markdownify-mcp CVE-2026-14699

Q: What is the CVSS score of CVE-2026-14699?

CVE-2026-14699 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-41724 MEDIUM

UNIX Symbolic Link (Symlink) Following (CWE-61)

2026-07-05 VulDB

GHSA-mf9r-r6pc-8fc6

Information Disclosure Markdownify Mcp

4.8

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.3 LOW

Local symlink exploitation requires low-privilege filesystem access; only limited confidentiality impact via path bypass, no integrity or availability effects apply.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 04:54 vuln.today

DescriptionCVE.org

A weakness has been identified in zcaceres markdownify-mcp up to 1.1.0. The affected element is the function assertPathAllowed of the file src/Markdownify.ts. Executing a manipulation can lead to symlink following. The attack can only be executed locally. The pull request to fix this issue awaits acceptance.

AnalysisAI

Symlink following in zcaceres markdownify-mcp up to version 1.1.0 allows a local low-privilege user to read files outside the intended directory boundary by exploiting insufficient path resolution in the assertPathAllowed function of src/Markdownify.ts. The function evaluates the user-supplied symbolic path rather than its canonicalized target, enabling an attacker to bypass the path restriction check and disclose arbitrary local files. No public exploit code exists at time of analysis, the vulnerability is not listed in CISA KEV, and a fix is pending as an unmerged pull request.

Technical ContextAI

markdownify-mcp is an MCP (Model Context Protocol) server package by zcaceres that converts web and local content to Markdown, identified by CPE cpe:2.3:a:zcaceres:markdownify-mcp:*:*:*:*:*:*:*:* for all versions through 1.1.0. The root cause is CWE-61 (UNIX Symbolic Link Following): the assertPathAllowed function in src/Markdownify.ts performs path allowlist enforcement against the literal user-supplied path string rather than first resolving it to its canonical real path. On UNIX-like systems, a symlink presents a different path than its target, so a symlink residing inside an allowed directory but pointing outside it will pass the check. This class of vulnerability is well-understood and typically remediated by calling realpath() or equivalent before the allowlist comparison.

RemediationAI

A fix is available as GitHub pull request #109 (https://github.com/zcaceres/markdownify-mcp/pull/109), which awaits maintainer acceptance - no tagged patched release has been confirmed at time of analysis. Users should monitor the repository and upgrade to any release following PR #109 merge once published. As an immediate compensating control, restrict the operating system user account running markdownify-mcp to read access only on directories containing non-sensitive files, limiting the value of any symlink escape. Additionally, avoid deploying markdownify-mcp in multi-tenant or shared environments where untrusted local users could create symlinks or influence path inputs to the server. Running the process in a chroot jail or container with a minimal filesystem mount further limits the files reachable via a symlink traversal.