Executive brief
markdownify-mcp is a tool used to convert web content, YouTube videos, and search results into Markdown format. A security flaw allows a local attacker on a shared system to predict the names of temporary files created during this conversion process. This could allow an attacker to intercept sensitive data being converted or overwrite other files on the system, potentially leading to data leaks or service disruptions.
Technical details
A vulnerability exists in the saveToTempFile function within src/Markdownify.ts of zcaceres markdownify-mcp up to 1.1.0. The application generates temporary filenames using only a shared directory and a millisecond-level timestamp (Date.now()), which is insufficiently random. Because the application uses fs.writeFileSync(), it follows existing symbolic links. A local attacker can perform a symlink attack by pre-creating a link at the predicted path, allowing them to redirect the output of a conversion to an arbitrary file or capture the converted content. This affects the webpage-to-markdown, youtube-to-markdown, and bing-search-to-markdown components. A pull request (PR #111) has been submitted to implement cryptographically secure random UUIDs and private temporary directories.
Affected products
- zcaceres markdownify-mcp up to 1.1.0
Timeline
- 2026-06-03: disclosed: Issue reported on GitHub repository
- 2026-06-03: other: Fix proposed via Pull Request 111
- 2026-07-05: advisory: CVE published via VulDB/NVD