CVE-2026-14702
zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values
CVSS Score
2.5
EPSS Score
0.0%
EPSS Percentile
0th
A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile of the file src/Markdownify.ts of the component webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. This manipulation causes insufficiently random values. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
| CWE | CWE-330 CWE-310 |
| Vendor | zcaceres |
| Product | markdownify-mcp |
| Published | Jul 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for zcaceres markdownify-mcp
Be the first to know when new low vulnerabilities affecting zcaceres markdownify-mcp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
zcaceres / markdownify-mcp
1.0 1.1.0
References
vuldb.com: https://vuldb.com/vuln/376298 vuldb.com: https://vuldb.com/vuln/376298/cti vuldb.com: https://vuldb.com/cve/CVE-2026-14702 vuldb.com: https://vuldb.com/submit/846942 github.com: https://github.com/zcaceres/markdownify-mcp/issues/110 github.com: https://github.com/zcaceres/markdownify-mcp/pull/111 github.com: https://github.com/zcaceres/markdownify-mcp/
Credits
🔍 Dem0000000 (VulDB User) VulDB CNA Team