CVE-2026-14699: Symlink Following in markdownify-mcp up to 1.1.0

Technical summary

The vulnerability exists in the assertPathAllowed function within src/Markdownify.ts of markdownify-mcp versions up to 1.1.0. The function fails to properly validate or restrict symlink traversal, allowing an authenticated local user to construct paths that resolve through symbolic links to sensitive files. This is classified as CWE-59 (Improper Link Resolution Before File Access) and CWE-61 (UNIX Symbolic Link Following), both classic path-traversal attack vectors. The weakness permits information disclosure with confidentiality impact.

Business impact

The exposure is primarily an information-disclosure risk in environments where markdownify-mcp is deployed on shared systems or in containers with multiple user accounts. An unprivileged user could read configuration files, API keys, or other sensitive data belonging to other users or the application itself. In single-user or tightly controlled environments, the risk is minimal. The low CVSS score reflects the requirement for local access and low privilege.

Affected systems

markdownify-mcp versions up to and including 1.1.0 are affected. The vulnerability is specific to deployments running on UNIX-like systems where symbolic link behavior is present. No known widespread commercial products depend critically on this library as a core component, though it may be used in niche Markdown processing pipelines or developer tools.

Exploitability

Exploitation requires local system access and an unprivileged user account—not remote or unauthenticated attacks. An attacker must already have a shell or interactive session on the target system. The manipulation itself is straightforward once access is gained: creating symbolic links in predictable paths that the application will follow. The attack is not listed in the CISA KEV catalog, indicating no evidence of active exploitation in the wild as of the publication date.

Remediation

Update markdownify-mcp to a patched version when available. A pull request addressing the issue has been submitted but awaits acceptance and release. Users should monitor the project repository for version updates and apply them promptly once released. As an interim measure, restrict file system permissions so that unprivileged users cannot create symbolic links in directories where markdownify-mcp operates, or run the application in isolated environments (containers, separate user accounts with minimal permissions).

Patch guidance

Patch availability depends on the project maintainer accepting and releasing the pending pull request. Check the markdownify-mcp GitHub repository or npm package registry for a version greater than 1.1.0. Once a patched release is available, upgrade via npm or your package manager. Verify the fix by confirming the assertPathAllowed function now properly validates symlink targets or rejects symlink operations entirely.

Detection guidance

Monitor system logs for symlink creation attempts in directories where markdownify-mcp reads or writes files. Use file integrity monitoring (FIM) tools to detect unauthorized symlink creation. Review access logs for unprivileged users accessing sensitive files through the application. In containerized environments, enforce read-only root filesystems and restrict symlink capabilities via seccomp or AppArmor profiles to limit the attack surface.

Why prioritize this

This vulnerability merits a medium-priority remediation timeline despite its low CVSS score. The reason is two-fold: first, it affects a development or deployment tool that may be used in CI/CD pipelines or infrastructure automation where symlink attacks could expose secrets; second, the fix is straightforward and low-risk once available. Prioritize patching in multi-user or shared hosting environments; defer if markdownify-mcp is used only in isolated, single-user contexts.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW) reflects the requirement for local attack vector, low privilege, and confidentiality-only impact. No integrity or availability harm is possible through this vector. The score would be higher if remote exploitation or privilege escalation were possible, or if the vulnerability enabled code execution. The low score does not mean the issue is negligible in sensitive environments; it reflects attack difficulty and scope constraints.

Frequently asked questions