{"id":"CVE-2026-53766","aliases":["GHSA-8qf9-62x2-82pp"],"title":"chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots","summary":"chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots","severity":"medium","cvss":6.1,"cwe":["CWE-22","CWE-59"],"vendor":"chrome-devtools-mcp","product":"chrome-devtools-mcp","ecosystem":"npm","affected":["chrome-devtools-mcp >= 0.24.0, <= 1.0.1"],"patched":["chrome-devtools-mcp 1.1.0"],"published":"2026-08-17","updated":"2026-08-17","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-8qf9-62x2-82pp","references":[{"url":"https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-8qf9-62x2-82pp"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53766"},{"url":"https://github.com/ChromeDevTools/chrome-devtools-mcp/pull/2127"},{"url":"https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/176eb695137d9c46a61e2d4d5571880c5145cf46"},{"url":"https://github.com/ChromeDevTools/chrome-devtools-mcp/releases/tag/chrome-devtools-mcp-v1.1.0"},{"url":"https://github.com/advisories/GHSA-8qf9-62x2-82pp"}],"tags":["ghsa","npm"],"epss":0.00117,"epssPercentile":0.01907,"ingestedAt":"2026-08-17T22:01:16.817Z","slug":"CVE-2026-53766","body":"## Overview\n\n### Summary\n\nI originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an unfixed security issue.\n\n`McpContext.validatePath()` enforces workspace `roots` by checking whether `path.resolve(filePath)` textually falls under one of the configured root paths. `path.resolve()` does not canonicalize symbolic links. As a result, a symlink inside a configured workspace root can point to a file outside that root, pass validation, and then be followed by downstream file read/write operations.\n\nThis bypass applies even when the MCP client correctly declares the `roots` capability with a non-empty list. It is separate from the documented legacy behavior where missing `roots` capability allows all paths.\n\nThe practical impact is a workspace-boundary bypass. In the write direction, filePath-writing tools can overwrite out-of-root files through an in-root symlink. In the read direction, `upload_file` can read through the symlink and send the file to the currently selected web page.\n\n### Details\n\nAffected code:\n\n`src/McpContext.ts:178-199`\n\n```ts\nvalidatePath(filePath?: string): void {\n  if (filePath === undefined) {\n    return;\n  }\n  const roots = this.roots();\n  if (roots === undefined) {\n    return;\n  }\n  const absolutePath = path.resolve(filePath);\n  for (const root of roots) {\n    const rootPath = path.resolve(fileURLToPath(root.uri));\n    if (\n      absolutePath === rootPath ||\n      absolutePath.startsWith(rootPath + path.sep)\n    ) {\n      return;\n    }\n  }\n  throw new Error(\n    `Access denied: path ${filePath} is not within any of the workspace roots ${JSON.stringify(roots)}.`,\n  );\n}\n```\n\n`path.resolve()` only normalizes path text such as `.` and `..`. It does not call `realpath()` and does not resolve symlinks. Therefore, a path like:\n\n```text\n/workspace/project/cache/profile\n```\n\ncan textually pass the `/workspace` prefix check even when `cache/profile` is a symlink to:\n\n```text\n/home/user/.aws/credentials\n```\n\nDownstream consumers then perform real filesystem operations without `O_NOFOLLOW`:\n\n- `src/McpContext.ts:720-738` `saveFile()` uses `fs.mkdir({recursive: true})` and `fs.writeFile()`.\n- `src/tools/input.ts:454-497` `upload_file` calls `puppeteer.uploadFile(filePath)` or `fileChooser.accept([filePath])`.\n- Other filePath-writing tools include screenshots, heap snapshots, network response save paths, snapshots, screencasts, Lighthouse output, and performance trace saves.\n\nThis is not a TOCTOU/race condition. The symlink exists before validation and the PoC uses a single process. The issue is a canonicalization bypass / improper link resolution.\n\nPreconditions:\n\n- The MCP client declares `roots` and supplies at least one workspace root.\n- A symlink exists inside the workspace and points outside the workspace.\n- For the remote prompt-injection chain, the user processes untrusted page content while chrome-devtools-mcp is connected.\n\nA remote attacker does not need local access if a suitable workspace-internal symlink already exists, or if another trusted tool/workflow can create it. Without such a symlink, the issue is a local/workspace-state-dependent boundary bypass.\n\n### PoC\n\nConceptual exploitation with a configured root:\n\n```text\nConfigured roots:\n  file:///workspace\n\nWorkspace path:\n  /workspace/project/cache/profile -> /home/user/.aws/credentials\n\nTool call:\n  upload_file({\n    filePath: \"/workspace/project/cache/profile\",\n    uid: \"<file input element on current page>\"\n  })\n\nResult:\n  validatePath() accepts the path because it textually starts with /workspace.\n  Puppeteer follows the symlink and uploads the target file to the page.\n```\n\nLab-only PoC that replicates the exact validation logic and subsequent write. It writes only inside a fresh temporary directory and touches no system paths:\n\n```js\nconst path = require('node:path');\nconst fs = require('node:fs');\nconst os = require('node:os');\nconst {pathToFileURL, fileURLToPath} = require('node:url');\n\nconst lab = fs.mkdtempSync(path.join(os.tmpdir(), 'cdtmcp-lab-'));\n\ntry {\n  fs.chmodSync(lab, 0o755);\n\n  const workspace = path.join(lab, 'workspace');\n  fs.mkdirSync(workspace);\n\n  const outside = path.join(lab, 'outside-secret.txt');\n  fs.writeFileSync(outside, 'sensitive outside content\\n');\n\n  const symlinkInside = path.join(workspace, 'innocent.txt');\n  fs.symlinkSync(outside, symlinkInside);\n\n  function validatePath(filePath, roots) {\n    const absolutePath = path.resolve(filePath);\n    for (const root of roots) {\n      const rootPath = path.resolve(fileURLToPath(root.uri));\n      if (\n        absolutePath === rootPath ||\n        absolutePath.startsWith(rootPath + path.sep)\n      ) {\n        return true;\n      }\n    }\n    throw new Error(`Access denied: ${filePath}`);\n  }\n\n  const roots = [{uri: pathToFileURL(workspace).href, name: 'workspace'}];\n  validatePath(symlinkInside, roots);\n\n  fs.writeFileSync(symlinkInside, 'OVERWRITTEN BY MCP\\n');\n\n  console.log(fs.readFileSync(outside, 'utf8'));\n  // -> \"OVERWRITTEN BY MCP\"\n} finally {\n  fs.rmSync(lab, {recursive: true, force: true});\n}\n```\n\nObserved result:\n\n```text\nvalidatePath() accepts the in-root symlink path.\nThe subsequent write follows the symlink and modifies the out-of-root target.\n```\n\nI can provide an end-to-end MCP client reproduction if needed. The lab PoC above demonstrates the root cause using the same validation logic as the server.\n\n### Impact\n\nWho can exploit:\n\n- A local process/user or trusted workflow that can create a symlink inside the workspace.\n- A remote page/prompt-injection attacker, if a suitable workspace-internal symlink already exists or can be created by another trusted workflow/tool.\n\nSecurity impact:\n\n- Integrity: tools that write to `filePath` can overwrite files outside the configured workspace root through an in-root symlink.\n- Confidentiality: `upload_file` can read a file outside the workspace through an in-root symlink and attach it to a file input on the current page.\n- Stealth/auditability: the exfiltration path goes through normal page file-upload behavior, and chrome-devtools-mcp does not appear to log the canonical path that was uploaded.\n\nExample sensitive files reachable if symlinked into the workspace:\n\n- Cloud credentials such as `~/.aws/credentials`, `~/.config/gcloud/...`, or `~/.azure/...`.\n- SSH private keys or `.ssh` files readable by the user.\n- Project secrets such as `.env`, `.npmrc`, `.netrc`, `secrets.json`, and API tokens.\n- Out-of-workspace source files or configuration files.\n\nSeverity:\n\n- Suggested GitHub severity: Moderate.\n- CVSS v3.1 chain estimate: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`.\n- AC:H reflects that a workspace-internal symlink must exist at validation time.\n\nSuggested fix:\n\nCanonicalize paths before comparing against roots. For an existing file, use `fs.realpath()` on the path. For a new file, resolve the parent directory with `fs.realpath()` and re-join the basename.\n\n```ts\nasync validatePath(filePath?: string): Promise<void> {\n  if (filePath === undefined) return;\n  const roots = this.roots();\n  if (roots === undefined) return;\n\n  const abs = path.resolve(filePath);\n  let canonical;\n  try {\n    canonical = await fs.realpath(abs);\n  } catch (err) {\n    if (err.code === 'ENOENT') {\n      const parent = await fs.realpath(path.dirname(abs));\n      canonical = path.join(parent, path.basename(abs));\n    } else {\n      throw err;\n    }\n  }\n\n  for (const root of roots) {\n    const canonicalRoot = await fs.realpath(fileURLToPath(root.uri));\n    if (\n      canonical === canonicalRoot ||\n      canonical.startsWith(canonicalRoot + path.sep)\n    ) {\n      return;\n    }\n  }\n\n  throw new Error(\n    `Access denied: ${filePath} (canonical: ${canonical}) is not within any workspace root.`,\n  );\n}\n\n## Affected packages\n\n- `chrome-devtools-mcp >= 0.24.0, <= 1.0.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `chrome-devtools-mcp 1.1.0`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}