chrome-devtools-mcp vulnerabilities
CVEs whose affected-version data names the chrome-devtools-mcp package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-53766Medium· 6.1chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
▾ Sunlitchrome-devtools-mcp · chrome-devtools-mcpEPSS 0.12%via GHSA
CVE-2026-53765Medium· 6.1Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory
Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory
▾ Sunlitchrome-devtools-mcp · chrome-devtools-mcpEPSS 0.10%via GHSA