{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "1.1.0"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "chrome-devtools-mcp",
        "purl": "pkg:brew/chrome-devtools-mcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.24.0"
            },
            {
              "fixed": "1.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "git",
    "upstream_evidence": [
      {
        "ecosystem": "GIT",
        "key": "https://github.com/chromedevtools/chrome-devtools-mcp",
        "name": "https://github.com/chromedevtools/chrome-devtools-mcp",
        "strategy": "git",
        "subject_version": "1.12.0"
      },
      {
        "ecosystem": "npm",
        "key": "pkg:npm/chrome-devtools-mcp@1.12.0",
        "name": "chrome-devtools-mcp",
        "strategy": "registry",
        "subject_version": "1.12.0"
      }
    ]
  },
  "details": "Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.24.0 until 1.1.0, McpContext.validatePath() enforces workspace roots by checking whether path.resolve(filePath) textually falls under one of the configured root paths. path.resolve() does not canonicalize symbolic links. As a result, a symlink inside a configured workspace root can point to a file outside that root, pass validation, and then be followed by downstream file read/write operations. This bypass applies even when the MCP client correctly declares the roots capability with a non-empty list. It is separate from the documented legacy behavior where missing roots capability allows all paths. The practical impact is a workspace-boundary bypass. In the write direction, filePath-writing tools can overwrite out-of-root files through an in-root symlink. In the read direction, upload_file can read through the symlink and send the file to the currently selected web page. This vulnerability is fixed in 1.1.0.",
  "id": "BREW-chrome-devtools-mcp-CVE-2026-53766",
  "modified": "2026-10-26T09:26:35Z",
  "published": "2026-08-18T08:44:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53766.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-8qf9-62x2-82pp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53766"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots",
  "upstream": [
    "CVE-2026-53766",
    "GHSA-8qf9-62x2-82pp"
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "chrome-devtools-mcp",
          "vendor": "ChromeDevTools",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.24.0, \u003c 1.1.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome-devtools-mcp:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "9BD336BF-0F30-4708-8AEA-E0B2144FFC10",
              "versionEndExcluding": "1.1.0",
              "versionStartIncluding": "0.24.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.24.0 until 1.1.0, McpContext.validatePath() enforces workspace roots by checking whether path.resolve(filePath) textually falls under one of the configured root paths. path.resolve() does not canonicalize symbolic links. As a result, a symlink inside a configured workspace root can point to a file outside that root, pass validation, and then be followed by downstream file read/write operations. This bypass applies even when the MCP client correctly declares the roots capability with a non-empty list. It is separate from the documented legacy behavior where missing roots capability allows all paths. The practical impact is a workspace-boundary bypass. In the write direction, filePath-writing tools can overwrite out-of-root files through an in-root symlink. In the read direction, upload_file can read through the symlink and send the file to the currently selected web page. This vulnerability is fixed in 1.1.0."
    },
    {
      "lang": "es",
      "value": "Chrome DevTools para agentes (chrome-devtools-mcp) permite que su agente de codificaci\u00f3n controle e inspeccione un navegador Chrome en vivo. Desde 0.24.0 hasta 1.1.0, McpContext.validatePath() aplica las ra\u00edces del espacio de trabajo al verificar si path.resolve(filePath) cae textualmente bajo una de las rutas ra\u00edz configuradas. path.resolve() no canoniza enlaces simb\u00f3licos. Como resultado, un enlace simb\u00f3lico dentro de una ra\u00edz de espacio de trabajo configurada puede apuntar a un archivo fuera de esa ra\u00edz, pasar la validaci\u00f3n y luego ser seguido por operaciones de lectura/escritura de archivos posteriores. Esta omisi\u00f3n se aplica incluso cuando el cliente MCP declara correctamente la capacidad de ra\u00edces con una lista no vac\u00eda. Est\u00e1 separado del comportamiento heredado documentado donde la capacidad de ra\u00edces faltante permite todas las rutas. El impacto pr\u00e1ctico es una omisi\u00f3n del l\u00edmite del espacio de trabajo. En la direcci\u00f3n de escritura, las herramientas de escritura de filePath pueden sobrescribir archivos fuera de la ra\u00edz a trav\u00e9s de un enlace simb\u00f3lico dentro de la ra\u00edz. En la direcci\u00f3n de lectura, upload_file puede leer a trav\u00e9s del enlace simb\u00f3lico y enviar el archivo a la p\u00e1gina web actualmente seleccionada. Esta vulnerabilidad est\u00e1 corregida en 1.1.0."
    }
  ],
  "id": "CVE-2026-53766",
  "lastModified": "2026-10-25T23:10:00.167",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53766",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-25T23:13:11.013103Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-24T22:16:47.917",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-8qf9-62x2-82pp"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-8qf9-62x2-82pp"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "chrome-devtools-mcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.24.0"
            },
            {
              "fixed": "1.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53766"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T21:56:12Z",
    "nvd_published_at": "2026-06-24T22:16:47Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nI originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an unfixed security issue.\n\n`McpContext.validatePath()` enforces workspace `roots` by checking whether `path.resolve(filePath)` textually falls under one of the configured root paths. `path.resolve()` does not canonicalize symbolic links. As a result, a symlink inside a configured workspace root can point to a file outside that root, pass validation, and then be followed by downstream file read/write operations.\n\nThis bypass applies even when the MCP client correctly declares the `roots` capability with a non-empty list. It is separate from the documented legacy behavior where missing `roots` capability allows all paths.\n\nThe practical impact is a workspace-boundary bypass. In the write direction, filePath-writing tools can overwrite out-of-root files through an in-root symlink. In the read direction, `upload_file` can read through the symlink and send the file to the currently selected web page.\n\n### Details\n\nAffected code:\n\n`src/McpContext.ts:178-199`\n\n```ts\nvalidatePath(filePath?: string): void {\n  if (filePath === undefined) {\n    return;\n  }\n  const roots = this.roots();\n  if (roots === undefined) {\n    return;\n  }\n  const absolutePath = path.resolve(filePath);\n  for (const root of roots) {\n    const rootPath = path.resolve(fileURLToPath(root.uri));\n    if (\n      absolutePath === rootPath ||\n      absolutePath.startsWith(rootPath + path.sep)\n    ) {\n      return;\n    }\n  }\n  throw new Error(\n    `Access denied: path ${filePath} is not within any of the workspace roots ${JSON.stringify(roots)}.`,\n  );\n}\n```\n\n`path.resolve()` only normalizes path text such as `.` and `..`. It does not call `realpath()` and does not resolve symlinks. Therefore, a path like:\n\n```text\n/workspace/project/cache/profile\n```\n\ncan textually pass the `/workspace` prefix check even when `cache/profile` is a symlink to:\n\n```text\n/home/user/.aws/credentials\n```\n\nDownstream consumers then perform real filesystem operations without `O_NOFOLLOW`:\n\n- `src/McpContext.ts:720-738` `saveFile()` uses `fs.mkdir({recursive: true})` and `fs.writeFile()`.\n- `src/tools/input.ts:454-497` `upload_file` calls `puppeteer.uploadFile(filePath)` or `fileChooser.accept([filePath])`.\n- Other filePath-writing tools include screenshots, heap snapshots, network response save paths, snapshots, screencasts, Lighthouse output, and performance trace saves.\n\nThis is not a TOCTOU/race condition. The symlink exists before validation and the PoC uses a single process. The issue is a canonicalization bypass / improper link resolution.\n\nPreconditions:\n\n- The MCP client declares `roots` and supplies at least one workspace root.\n- A symlink exists inside the workspace and points outside the workspace.\n- For the remote prompt-injection chain, the user processes untrusted page content while chrome-devtools-mcp is connected.\n\nA remote attacker does not need local access if a suitable workspace-internal symlink already exists, or if another trusted tool/workflow can create it. Without such a symlink, the issue is a local/workspace-state-dependent boundary bypass.\n\n### PoC\n\nConceptual exploitation with a configured root:\n\n```text\nConfigured roots:\n  file:///workspace\n\nWorkspace path:\n  /workspace/project/cache/profile -\u003e /home/user/.aws/credentials\n\nTool call:\n  upload_file({\n    filePath: \"/workspace/project/cache/profile\",\n    uid: \"\u003cfile input element on current page\u003e\"\n  })\n\nResult:\n  validatePath() accepts the path because it textually starts with /workspace.\n  Puppeteer follows the symlink and uploads the target file to the page.\n```\n\nLab-only PoC that replicates the exact validation logic and subsequent write. It writes only inside a fresh temporary directory and touches no system paths:\n\n```js\nconst path = require(\u0027node:path\u0027);\nconst fs = require(\u0027node:fs\u0027);\nconst os = require(\u0027node:os\u0027);\nconst {pathToFileURL, fileURLToPath} = require(\u0027node:url\u0027);\n\nconst lab = fs.mkdtempSync(path.join(os.tmpdir(), \u0027cdtmcp-lab-\u0027));\n\ntry {\n  fs.chmodSync(lab, 0o755);\n\n  const workspace = path.join(lab, \u0027workspace\u0027);\n  fs.mkdirSync(workspace);\n\n  const outside = path.join(lab, \u0027outside-secret.txt\u0027);\n  fs.writeFileSync(outside, \u0027sensitive outside content\\n\u0027);\n\n  const symlinkInside = path.join(workspace, \u0027innocent.txt\u0027);\n  fs.symlinkSync(outside, symlinkInside);\n\n  function validatePath(filePath, roots) {\n    const absolutePath = path.resolve(filePath);\n    for (const root of roots) {\n      const rootPath = path.resolve(fileURLToPath(root.uri));\n      if (\n        absolutePath === rootPath ||\n        absolutePath.startsWith(rootPath + path.sep)\n      ) {\n        return true;\n      }\n    }\n    throw new Error(`Access denied: ${filePath}`);\n  }\n\n  const roots = [{uri: pathToFileURL(workspace).href, name: \u0027workspace\u0027}];\n  validatePath(symlinkInside, roots);\n\n  fs.writeFileSync(symlinkInside, \u0027OVERWRITTEN BY MCP\\n\u0027);\n\n  console.log(fs.readFileSync(outside, \u0027utf8\u0027));\n  // -\u003e \"OVERWRITTEN BY MCP\"\n} finally {\n  fs.rmSync(lab, {recursive: true, force: true});\n}\n```\n\nObserved result:\n\n```text\nvalidatePath() accepts the in-root symlink path.\nThe subsequent write follows the symlink and modifies the out-of-root target.\n```\n\nI can provide an end-to-end MCP client reproduction if needed. The lab PoC above demonstrates the root cause using the same validation logic as the server.\n\n### Impact\n\nWho can exploit:\n\n- A local process/user or trusted workflow that can create a symlink inside the workspace.\n- A remote page/prompt-injection attacker, if a suitable workspace-internal symlink already exists or can be created by another trusted workflow/tool.\n\nSecurity impact:\n\n- Integrity: tools that write to `filePath` can overwrite files outside the configured workspace root through an in-root symlink.\n- Confidentiality: `upload_file` can read a file outside the workspace through an in-root symlink and attach it to a file input on the current page.\n- Stealth/auditability: the exfiltration path goes through normal page file-upload behavior, and chrome-devtools-mcp does not appear to log the canonical path that was uploaded.\n\nExample sensitive files reachable if symlinked into the workspace:\n\n- Cloud credentials such as `~/.aws/credentials`, `~/.config/gcloud/...`, or `~/.azure/...`.\n- SSH private keys or `.ssh` files readable by the user.\n- Project secrets such as `.env`, `.npmrc`, `.netrc`, `secrets.json`, and API tokens.\n- Out-of-workspace source files or configuration files.\n\nSeverity:\n\n- Suggested GitHub severity: Moderate.\n- CVSS v3.1 chain estimate: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`.\n- AC:H reflects that a workspace-internal symlink must exist at validation time.\n\nSuggested fix:\n\nCanonicalize paths before comparing against roots. For an existing file, use `fs.realpath()` on the path. For a new file, resolve the parent directory with `fs.realpath()` and re-join the basename.\n\n```ts\nasync validatePath(filePath?: string): Promise\u003cvoid\u003e {\n  if (filePath === undefined) return;\n  const roots = this.roots();\n  if (roots === undefined) return;\n\n  const abs = path.resolve(filePath);\n  let canonical;\n  try {\n    canonical = await fs.realpath(abs);\n  } catch (err) {\n    if (err.code === \u0027ENOENT\u0027) {\n      const parent = await fs.realpath(path.dirname(abs));\n      canonical = path.join(parent, path.basename(abs));\n    } else {\n      throw err;\n    }\n  }\n\n  for (const root of roots) {\n    const canonicalRoot = await fs.realpath(fileURLToPath(root.uri));\n    if (\n      canonical === canonicalRoot ||\n      canonical.startsWith(canonicalRoot + path.sep)\n    ) {\n      return;\n    }\n  }\n\n  throw new Error(\n    `Access denied: ${filePath} (canonical: ${canonical}) is not within any workspace root.`,\n  );\n}",
  "id": "GHSA-8qf9-62x2-82pp",
  "modified": "2026-08-17T21:56:12Z",
  "published": "2026-08-17T21:56:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-8qf9-62x2-82pp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53766"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ChromeDevTools/chrome-devtools-mcp/pull/2127"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/176eb695137d9c46a61e2d4d5571880c5145cf46"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ChromeDevTools/chrome-devtools-mcp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ChromeDevTools/chrome-devtools-mcp/releases/tag/chrome-devtools-mcp-v1.1.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots"
}