CVE-2026-14702 Overview
CVE-2026-14702 affects the zcaceres markdownify-mcp project through version 1.1.0. The flaw resides in the saveToTempFile function in src/Markdownify.ts, which is used by the webpage-to-markdown, youtube-to-markdown, and bing-search-to-markdown components. The function generates temporary file names using insufficiently random values [CWE-310]. A local attacker with low privileges may predict the generated file paths and interfere with temporary file creation or content. Exploitation requires local access and high attack complexity, and a pull request to fix the issue is awaiting acceptance.
Critical Impact
Predictable temporary file names in an MCP server component may allow a local attacker to read or influence transient markdown conversion output.
Affected Products
- zcaceres markdownify-mcp versions up to and including 1.1.0
- Component: webpage-to-markdown / youtube-to-markdown / bing-search-to-markdown
- Affected function: saveToTempFile in src/Markdownify.ts
Discovery Timeline
- 2026-07-05 - CVE-2026-14702 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-14702
Vulnerability Analysis
The vulnerability is categorized under [CWE-310] Cryptographic Issues, specifically the use of insufficiently random values. The saveToTempFile function in src/Markdownify.ts writes intermediate conversion output to a temporary path on the local filesystem. Because the file name is derived from a weak or predictable source of entropy, an attacker executing code on the same host can enumerate or precompute the resulting paths. This creates a window in which the attacker may read the temporary file, race the writer, or plant a file at the predicted location before it is used by the MCP server.
The advisory notes that a public exploit has been referenced, and a pull request to remediate the issue is pending acceptance in the upstream repository.
Root Cause
The root cause is the use of an insufficiently random value when constructing temporary file names inside saveToTempFile. Predictable naming schemes such as time-based counters, sequential identifiers, or non-cryptographic pseudo-random generators do not provide the unpredictability required to protect shared filesystem locations. When these paths are used in a shared temp directory, any local user process can reason about the next generated name.
Attack Vector
The attack is limited to local execution. An attacker with low privileges on the host running markdownify-mcp must monitor or predict the temporary filename produced by saveToTempFile. High complexity is required because the attacker must win a timing race or align with the exact moment the MCP server writes converted markdown output. Refer to the GitHub Issue Tracker and GitHub Pull Request for technical discussion.
No verified proof-of-concept code is included in the advisory. Readers should consult the GitHub PoC Repository for source-level detail on the vulnerable function.
Detection Methods for CVE-2026-14702
Indicators of Compromise
- Unexpected files appearing in the system temporary directory with names matching the markdownify-mcp output pattern.
- Local processes owned by non-service accounts reading or writing files in the temp path used by the MCP server.
- Access-time anomalies on temporary markdown files immediately after markdownify-mcp requests.
Detection Strategies
- Inventory hosts running Node.js Model Context Protocol servers and identify installations of zcaceres/markdownify-mcp at version 1.1.0 or earlier.
- Enable filesystem auditing on the temp directory used by the MCP process to log create, read, and rename events.
- Review process telemetry for local users interacting with files whose names match the saveToTempFile output.
Monitoring Recommendations
- Alert on file access events in /tmp (or the platform equivalent) by user contexts other than the MCP service account.
- Track version metadata for markdownify-mcp in software bills of materials and flag downgrades or unpatched installs.
- Log MCP server activity centrally and correlate with local filesystem events to identify race-condition patterns.
How to Mitigate CVE-2026-14702
Immediate Actions Required
- Restrict local access to hosts running markdownify-mcp to trusted users only.
- Run the MCP server under a dedicated service account with a private temporary directory (for example, using PrivateTmp=yes under systemd).
- Monitor the GitHub Pull Request for merge status and apply the fix once released.
Patch Information
At the time of publication, no fixed release of zcaceres/markdownify-mcp is available. The remediation pull request is pending acceptance upstream. Track the VulDB CVE Record and the GitHub Issue Tracker for release information. Once merged, users should upgrade beyond version 1.1.0 and confirm that temporary file names are generated using a cryptographically secure random source such as Node.js crypto.randomBytes.
Workarounds
- Configure the MCP server process to use a per-user temporary directory that is not world-readable.
- Set restrictive permissions (chmod 700) on the directory used by saveToTempFile if it can be overridden via environment variable.
- Avoid running markdownify-mcp on multi-tenant hosts until the patch is merged.
# Example: isolate the MCP server temp directory
sudo install -d -m 700 -o mcpuser -g mcpuser /var/lib/markdownify-mcp/tmp
sudo -u mcpuser TMPDIR=/var/lib/markdownify-mcp/tmp \
node /opt/markdownify-mcp/dist/index.js
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
