Log in Start free

Vulnerability · Published Jul 5, 2026 · Assigned by VulDB

CVE-2026-14702zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values

Low 2.5

In plain English

A low-severity weak randomness in markdownify-mcp from zcaceres. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)2.5Low
Exploit odds (30 days)0.1%top 96.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile of the file src/Markdownify.ts of the component webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. This manipulation causes insufficiently random values. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

Affected products (as reported)

VendorProductVersions
zcaceres markdownify-mcp 1.01.1.0

Weakness: CWE-330, CWE-310 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References