CVE-2026-53766

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

Published

2026-08-17

Modified

2026-08-17

EPSS percentile

1%

Aliases

GHSA-8qf9-62x2-82pp

Sources

github-advisory

Summary

### Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an unfixed security issue. `McpContext.validatePath()` enforces workspace `roots` by checking whether `path.resolve(filePath)` textually falls under one of the configured root paths. `path.resolve()` does not canonicalize symbolic links. As a result, a symlink inside a configured workspace root can point to a file outside that root, pass validation, and then be followed by downstream file read/write operations. This bypass applies even when the MCP client correctly declares the `roots` capability with a non-empty list. It is separate from the documented legacy behavior where missing `roots` capability allows all paths. The practical impact is a workspace-boundary bypass. In the write direction, filePath-writing tools can overwrite out-of-root files through an in-root symlink. In the read direction, `upload_file` can read through the symlink and send the file to the currently selected web page. ### Details Affected code: `src/McpContext.ts:178-199` ```ts validatePath(filePath?: string): void { if (filePath === undefined) { return; } const roots = this.roots(); if (roots === undefined) { return; } const absolutePath = path.resolve(filePath); for (const root of roots) { const rootPath = path.resolve(fileURLToPath(root.uri)); if ( absolutePath === rootPath || absolutePath.startsWith(rootPath + path.sep) ) { return; } } throw new Error( `Access denied: path ${filePath} is not within any of the workspace roots ${JSON.stringify(roots)}.`, ); } ``` `path.resolve()` only normalizes path text such as `.` and `..`. It does not call `realpath()` and does not resolve symlinks. Therefore, a path like: ```text /workspace/project/cache/profile ``` can textually pass the `/workspace` prefix check even when `cache/profile` is a symlink to: ```text /home/user/.aws/credentials ``` Downstream consumers then perform real filesystem operations without `O_NOFOLLOW`: - `src/McpContext.ts:720-738` `saveFile()` uses `fs.mkdir({recursive: true})` and `fs.writeFile()`. - `src/tools/input.ts:454-497` `upload_file` calls `puppeteer.uploadFile(filePath)` or `fileChooser.accept([filePath])`. - Other filePath-writing tools include screenshots, heap snapshots, network response save paths, snapshots, screencasts, Lighthouse output, and performance trace saves. This is not a TOCTOU/race condition. The symlink exists before validation and the PoC uses a single process. The issue is a canonicalization bypass / improper link resolution. Preconditions: - The MCP client declares `roots` and supplies at least one workspace root. - A symlink exists inside the workspace and points outside the workspace. - For the remote prompt-injection chain, the user processes untrusted page content while chrome-devtools-mcp is connected. A remote attacker does not need local access if a suitable workspace-internal symlink already exists, or if another trusted tool/workflow can create it. Without such a symlink, the issue is a local/workspace-state-dependent boundary bypass. ### PoC Conceptual exploitation with a configured root: ```text Configured roots: file:///workspace Workspace path: /workspace/project/cache/profile -> /home/user/.aws/credentials Tool call: upload_file({ filePath: "/workspace/project/cache/profile", uid: " " }) Result: validatePath() accepts the path because it textually starts with /workspace. Puppeteer follows the symlink and uploads the target file to the page. ``` Lab-only PoC that replicates the exact validation logic and subsequent write. It writes only inside a fresh temporary directory and touches no system paths: ```js con

Affected packages

Remediation: Upgrade to 1.1.0 or later.

References

• https://github.com/advisories/GHSA-8qf9-62x2-82pp