Vulnerabilities in pkg:npm/chrome-devtools-mcp

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8qf9-62x2-82pp",
  "modified" : "2026-08-17T21:56:12Z",
  "published" : "2026-08-17T21:56:12Z",
  "aliases" : [ "CVE-2026-53766" ],
  "summary" : "chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots",
  "details" : "### Summary\n\nI originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an unfixed security issue.\n\n`McpContext.validatePath()` enforces workspace `roots` by checking whether `path.resolve(filePath)` textually falls under one of the configured root paths. `path.resolve()` does not canonicalize symbolic links. As a result, a symlink inside a configured workspace root can point to a file outside that root, pass validation, and then be followed by downstream file read/write operations.\n\nThis bypass applies even when the MCP client correctly declares the `roots` capability with a non-empty list. It is separate from the documented legacy behavior where missing `roots` capability allows all paths.\n\nThe practical impact is a workspace-boundary bypass. In the write direction, filePath-writing tools can overwrite out-of-root files through an in-root symlink. In the read direction, `upload_file` can read through the symlink and send the file to the currently selected web page.\n\n### Details\n\nAffected code:\n\n`src/McpContext.ts:178-199`\n\n```ts\nvalidatePath(filePath?: string): void {\n  if (filePath === undefined) {\n    return;\n  }\n  const roots = this.roots();\n  if (roots === undefined) {\n    return;\n  }\n  const absolutePath = path.resolve(filePath);\n  for (const root of roots) {\n    const rootPath = path.resolve(fileURLToPath(root.uri));\n    if (\n      absolutePath === rootPath ||\n      absolutePath.startsWith(rootPath + path.sep)\n    ) {\n      return;\n    }\n  }\n  throw new Error(\n    `Access denied: path ${filePath} is not within any of the workspace roots ${JSON.stringify(roots)}.`,\n  );\n}\n```\n\n`path.resolve()` only normalizes path text such as `.` and `..`. It does not call `realpath()` and does not resolve symlinks. Therefore, a path like:\n\n```text\n/workspace/project/cache/profile\n```\n\ncan textually pass the `/workspace` prefix check even when `cache/profile` is a symlink to:\n\n```text\n/home/user/.aws/credentials\n```\n\nDownstream consumers then perform real filesystem operations without `O_NOFOLLOW`:\n\n- `src/McpContext.ts:720-738` `saveFile()` uses `fs.mkdir({recursive: true})` and `fs.writeFile()`.\n- `src/tools/input.ts:454-497` `upload_file` calls `puppeteer.uploadFile(filePath)` or `fileChooser.accept([filePath])`.\n- Other filePath-writing tools include screenshots, heap snapshots, network response save paths, snapshots, screencasts, Lighthouse output, and performance trace saves.\n\nThis is not a TOCTOU/race condition. The symlink exists before validation and the PoC uses a single process. The issue is a canonicalization bypass / improper link resolution.\n\nPreconditions:\n\n- The MCP client declares `roots` and supplies at least one workspace root.\n- A symlink exists inside the workspace and points outside the workspace.\n- For the remote prompt-injection chain, the user processes untrusted page content while chrome-devtools-mcp is connected.\n\nA remote attacker does not need local access if a suitable workspace-internal symlink already exists, or if another trusted tool/workflow can create it. Without such a symlink, the issue is a local/workspace-state-dependent boundary bypass.\n\n### PoC\n\nConceptual exploitation with a configured root:\n\n```text\nConfigured roots:\n  file:///workspace\n\nWorkspace path:\n  /workspace/project/cache/profile -> /home/user/.aws/credentials\n\nTool call:\n  upload_file({\n    filePath: \"/workspace/project/cache/profile\",\n    uid: \"<file input element on current page>\"\n  })\n\nResult:\n  validatePath() accepts the path because it textually starts with /workspace.\n  Puppeteer follows the symlink and uploads the target file to the page.\n```\n\nLab-only PoC that replicates the exact validation logic and subsequent write. It writes only inside a fresh temporary directory and touches no system paths:\n\n```js\nconst path = require('node:path');\nconst fs = require('node:fs');\nconst os = require('node:os');\nconst {pathToFileURL, fileURLToPath} = require('node:url');\n\nconst lab = fs.mkdtempSync(path.join(os.tmpdir(), 'cdtmcp-lab-'));\n\ntry {\n  fs.chmodSync(lab, 0o755);\n\n  const workspace = path.join(lab, 'workspace');\n  fs.mkdirSync(workspace);\n\n  const outside = path.join(lab, 'outside-secret.txt');\n  fs.writeFileSync(outside, 'sensitive outside content\\n');\n\n  const symlinkInside = path.join(workspace, 'innocent.txt');\n  fs.symlinkSync(outside, symlinkInside);\n\n  function validatePath(filePath, roots) {\n    const absolutePath = path.resolve(filePath);\n    for (const root of roots) {\n      const rootPath = path.resolve(fileURLToPath(root.uri));\n      if (\n        absolutePath === rootPath ||\n        absolutePath.startsWith(rootPath + path.sep)\n      ) {\n        return true;\n      }\n    }\n    throw new Error(`Access denied: ${filePath}`);\n  }\n\n  const roots = [{uri: pathToFileURL(workspace).href, name: 'workspace'}];\n  validatePath(symlinkInside, roots);\n\n  fs.writeFileSync(symlinkInside, 'OVERWRITTEN BY MCP\\n');\n\n  console.log(fs.readFileSync(outside, 'utf8'));\n  // -> \"OVERWRITTEN BY MCP\"\n} finally {\n  fs.rmSync(lab, {recursive: true, force: true});\n}\n```\n\nObserved result:\n\n```text\nvalidatePath() accepts the in-root symlink path.\nThe subsequent write follows the symlink and modifies the out-of-root target.\n```\n\nI can provide an end-to-end MCP client reproduction if needed. The lab PoC above demonstrates the root cause using the same validation logic as the server.\n\n### Impact\n\nWho can exploit:\n\n- A local process/user or trusted workflow that can create a symlink inside the workspace.\n- A remote page/prompt-injection attacker, if a suitable workspace-internal symlink already exists or can be created by another trusted workflow/tool.\n\nSecurity impact:\n\n- Integrity: tools that write to `filePath` can overwrite files outside the configured workspace root through an in-root symlink.\n- Confidentiality: `upload_file` can read a file outside the workspace through an in-root symlink and attach it to a file input on the current page.\n- Stealth/auditability: the exfiltration path goes through normal page file-upload behavior, and chrome-devtools-mcp does not appear to log the canonical path that was uploaded.\n\nExample sensitive files reachable if symlinked into the workspace:\n\n- Cloud credentials such as `~/.aws/credentials`, `~/.config/gcloud/...`, or `~/.azure/...`.\n- SSH private keys or `.ssh` files readable by the user.\n- Project secrets such as `.env`, `.npmrc`, `.netrc`, `secrets.json`, and API tokens.\n- Out-of-workspace source files or configuration files.\n\nSeverity:\n\n- Suggested GitHub severity: Moderate.\n- CVSS v3.1 chain estimate: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`.\n- AC:H reflects that a workspace-internal symlink must exist at validation time.\n\nSuggested fix:\n\nCanonicalize paths before comparing against roots. For an existing file, use `fs.realpath()` on the path. For a new file, resolve the parent directory with `fs.realpath()` and re-join the basename.\n\n```ts\nasync validatePath(filePath?: string): Promise<void> {\n  if (filePath === undefined) return;\n  const roots = this.roots();\n  if (roots === undefined) return;\n\n  const abs = path.resolve(filePath);\n  let canonical;\n  try {\n    canonical = await fs.realpath(abs);\n  } catch (err) {\n    if (err.code === 'ENOENT') {\n      const parent = await fs.realpath(path.dirname(abs));\n      canonical = path.join(parent, path.basename(abs));\n    } else {\n      throw err;\n    }\n  }\n\n  for (const root of roots) {\n    const canonicalRoot = await fs.realpath(fileURLToPath(root.uri));\n    if (\n      canonical === canonicalRoot ||\n      canonical.startsWith(canonicalRoot + path.sep)\n    ) {\n      return;\n    }\n  }\n\n  throw new Error(\n    `Access denied: ${filePath} (canonical: ${canonical}) is not within any workspace root.`,\n  );\n}",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "chrome-devtools-mcp"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.24.0"
      }, {
        "fixed" : "1.1.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.0.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-8qf9-62x2-82pp"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-53766"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ChromeDevTools/chrome-devtools-mcp/pull/2127"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/176eb695137d9c46a61e2d4d5571880c5145cf46"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ChromeDevTools/chrome-devtools-mcp"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ChromeDevTools/chrome-devtools-mcp/releases/tag/chrome-devtools-mcp-v1.1.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22", "CWE-59" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-17T21:56:12Z",
    "nvd_published_at" : "2026-06-24T22:16:47Z"
  }
}