CVE-2026-14699

EUVD-2026-41724
A weakness has been identified in zcaceres markdownify-mcp up to 1.1.0. The affected element is the function assertPathAllowed of the file src/Markdownify.ts. Executing a manipulation can lead to symlink following. The attack can only be executed locally. The pull request to fix this issue awaits acceptance.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 3%
Common Weakness Enumeration
References
https://github.com/zcaceres/markdownify-mcp/
https://github.com/zcaceres/markdownify-mcp/issues/108
https://github.com/zcaceres/markdownify-mcp/pull/109
https://vuldb.com/cve/CVE-2026-14699
https://vuldb.com/submit/846864
https://vuldb.com/vuln/376295
https://vuldb.com/vuln/376295/cti