CVE-2026-14702: Weak Randomness in markdownify-mcp Temporary File Creation

Technical summary

The vulnerability exists in the saveToTempFile function within src/Markdownify.ts, which is responsible for handling temporary file creation during markdown conversion operations (webpage-to-markdown, youtube-to-markdown, bing-search-to-markdown). The function generates temporary file names using insufficiently random values, falling under cryptographic weak randomness (CWE-330) and improper handling of cryptographic keys or random numbers (CWE-310). An attacker with local code execution privileges could exploit this to predict temporary file paths and gain read access to conversion data before cleanup. The flaw requires high attack complexity and local execution context, significantly limiting real-world risk.

Business impact

For organizations embedding markdownify-mcp in local applications or services, this flaw introduces a minor confidentiality risk. If temporary files created during markdown conversion contain sensitive input data—such as proprietary content from web pages or search results—a local attacker could theoretically read that data by predicting file paths. The risk is confined to multi-user systems or environments where attackers already have shell-level access. Single-tenant or air-gapped deployments face negligible exposure.

Affected systems

The vulnerability affects zcaceres/markdownify-mcp versions up to 1.1.0. Verify your installed version by checking your package.json or package-lock.json files if you consume this library. The impact is limited to local users on systems where the library is actively processing markdown conversions. Downstream consumers of this library who integrate it into web services or APIs should review their deployment architecture to determine if temporary files are accessible to untrusted local users.

Exploitability

The CVSS 3.1 score of 2.5 (LOW) reflects the high barriers to exploitation: the attacker must already have local system access, the attack complexity is high, and predictable file names require reverse-engineering the weak randomness algorithm. An exploit has been published, but practical weaponization remains difficult without deep knowledge of the specific temporary file naming scheme and active conversion timing. Remote exploitation is not feasible.

Remediation

Upgrade to a patched version of markdownify-mcp that implements cryptographically secure randomness for temporary file naming. A pull request addressing this issue is pending acceptance and integration by the project maintainers. Monitor the official zcaceres/markdownify-mcp repository for release announcements. In the interim, if feasible, restrict local system access to only trusted users and ensure temporary directories have appropriate file permissions.

Patch guidance

Verify the latest available version of markdownify-mcp against the official npm registry or GitHub repository. The fix should ensure that the saveToTempFile function uses cryptographically secure random number generation (e.g., Node.js crypto.randomBytes or similar) instead of weak randomization. If you maintain internal applications using this library, test the patched version in a non-production environment before rolling out broadly. Confirm that the updated version does not introduce breaking changes to your markdown conversion workflows.

Detection guidance

Monitor temporary file creation patterns in directories where your application stores conversion artifacts. If you observe temporary files with predictable naming sequences (e.g., incrementing numbers or simple patterns), investigate whether the vulnerable library version is in use. Review access logs for unusual file system access attempts targeting temporary directories. Organizations running markdownify-mcp should periodically audit installed package versions and supply-chain dependencies.

Why prioritize this

This vulnerability merits low urgency in most environments due to its CVSS 2.5 rating, local-only attack vector, and high attack complexity. However, organizations operating multi-tenant systems, shared hosting environments, or systems handling sensitive markdown conversion data should prioritize patching before the fixed version is released and verified. Single-tenant or offline deployments can defer action until a stable patch is available.

Risk score, explained

The CVSS 3.1 score of 2.5 reflects: (1) Local attack vector (AV:L)—requires existing system access; (2) High attack complexity (AC:H)—demands technical sophistication to predict randomness; (3) Low privilege requirements (PR:L)—any local user, not just administrators, could attempt exploitation; (4) Confidentiality impact only (C:L)—no integrity or availability effects; (5) Unchanged scope (S:U). The published exploit slightly elevates concern but does not change the fundamental difficulty of weaponization in typical deployments.

Frequently asked questions