CVE-2026-14699 Overview
CVE-2026-14699 is a symlink following vulnerability [CWE-59] affecting zcaceres markdownify-mcp versions up to 1.1.0. The flaw resides in the assertPathAllowed function in src/Markdownify.ts. An attacker with local access can manipulate path validation logic to follow symbolic links, bypassing intended file access restrictions. The vulnerability requires local access and low privileges to exploit. A pull request addressing the issue is pending acceptance in the upstream repository.
Critical Impact
Local attackers with low privileges can bypass path restrictions in markdownify-mcp through symlink following, potentially accessing files outside the intended scope of the Model Context Protocol server.
Affected Products
- zcaceres markdownify-mcp versions up to and including 1.1.0
- The assertPathAllowed function in src/Markdownify.ts
- Systems running the Model Context Protocol (MCP) server based on markdownify-mcp
Discovery Timeline
- 2026-07-05 - CVE-2026-14699 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-14699
Vulnerability Analysis
The vulnerability exists in the assertPathAllowed function within src/Markdownify.ts. This function is intended to validate that a requested file path falls within permitted directories before the markdownify-mcp server processes it. The check does not properly account for symbolic links resolving to locations outside allowed boundaries.
An attacker who can place or influence symbolic links on the local filesystem can craft a path that passes the assertPathAllowed validation. The underlying file operation then follows the symlink to an unintended target. This category of flaw is classified under [CWE-59]: Improper Link Resolution Before File Access.
Exploitation requires local access to the system running markdownify-mcp and low-privileged user access. No user interaction is required beyond triggering the server to process the crafted path.
Root Cause
The assertPathAllowed function validates the supplied path string against an allowlist without fully resolving symbolic links before comparison. When the file is subsequently accessed, the operating system dereferences the symlink and reaches a target outside the allowed set. The mismatch between the validated path and the accessed path is the core defect.
Attack Vector
An attacker with local shell access places a symbolic link inside an allowed directory that points to a sensitive file elsewhere on the system. The attacker then instructs the markdownify-mcp server to convert or read the linked file. The assertPathAllowed check succeeds on the link path, and the server reads the target file. This yields limited confidentiality impact against the process running the MCP server.
No verified public exploit code is available. See the GitHub Issue Tracker and GitHub Pull Request for technical details.
Detection Methods for CVE-2026-14699
Indicators of Compromise
- Unexpected symbolic links inside directories consumed by markdownify-mcp, particularly links pointing outside the configured working directory
- Access log entries showing markdownify-mcp reading files whose canonical path differs from the requested path
- File access by the markdownify-mcp process to sensitive system files such as /etc/passwd, configuration files, or user home directories not intended for MCP processing
Detection Strategies
- Monitor filesystem telemetry for symlink and symlinkat syscalls issued in directories used by markdownify-mcp
- Compare each requested path against its realpath resolution and flag deviations that cross allowlist boundaries
- Audit the markdownify-mcp process for reads outside its expected working directory using EDR file-access telemetry
Monitoring Recommendations
- Enable process-level file access auditing on hosts running markdownify-mcp
- Log all path arguments passed to the MCP server and correlate with resolved canonical paths
- Alert on any local user creating symlinks inside directories consumed by MCP tooling
How to Mitigate CVE-2026-14699
Immediate Actions Required
- Restrict local access to systems running markdownify-mcp to trusted users only
- Run the markdownify-mcp server under a dedicated low-privilege account with filesystem access limited to required directories
- Review directories consumed by markdownify-mcp and remove any unexpected symbolic links
- Track the pending GitHub Pull Request and apply the fix once merged
Patch Information
As of the last NVD update on 2026-07-06, the upstream fix is pending. The proposed change is available in the GitHub Pull Request against the markdownify-mcp repository. Additional record details are available at the VulDB CVE Record. Users should upgrade to a release incorporating the fix once published.
Workarounds
- Apply mandatory access controls such as AppArmor or SELinux to confine the markdownify-mcp process to its intended directories
- Use filesystem namespaces or containers to isolate markdownify-mcp and prevent access to sensitive host paths
- Manually apply the patch from the pending pull request after review, rebuilding src/Markdownify.ts to resolve paths with fs.realpath before allowlist comparison
- Disable or uninstall markdownify-mcp on multi-user systems until an official patched release is available
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
