CVE-2026-14702

A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile of the file src/Markdownify.ts of the component webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. This manipulation causes insufficiently random values. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

CVSS v3 2.5 LOW
CVSS v2.0 1.0 LOW

2.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

1.0^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:H/Au:S/C:P/I:N/A:N

Exploitability : 1.5 / Impact : 2.9

Access Vector LOCAL

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/zcaceres/markdownify-mcp/
https://github.com/zcaceres/markdownify-mcp/issues/110
https://github.com/zcaceres/markdownify-mcp/pull/111
https://vuldb.com/cve/CVE-2026-14702
https://vuldb.com/submit/846942
https://vuldb.com/vuln/376298
https://vuldb.com/vuln/376298/cti

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Se ha encontrado una vulnerabilidad en zcaceres markdownify-mcp hasta la versión 1.1.0. Esto afecta a la función saveToTempFile del archivo src/Markdownify.ts del componente webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. Esta manipulación causa valores insuficientemente aleatorios. El ataque está restringido a la ejecución local. Se necesita un alto grado de complejidad para el ataque. Se dice que la explotabilidad es difícil. El exploit ha sido publicado y puede ser utilizado. La pull request para solucionar este problema espera ser aceptada.

Information

Published : 2026-07-05 05:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-14702

Mitre link : CVE-2026-14702

CVE.ORG link : CVE-2026-14702

JSON object : View

Products Affected

No product.

CWE

CWE-310

Cryptographic Issues

CWE-330

Use of Insufficiently Random Values

{"id": "CVE-2026-14702", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14702", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T17:49:37.877689Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 1.0, "accessVector": "LOCAL", "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 1.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.0}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:zcaceres:markdownify-mcp:*:*:*:*:*:*:*:*"], "vendor": "zcaceres", "modules": ["webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown"], "product": "markdownify-mcp", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "1.1.0"}]}]}], "published": "2026-07-05T05:16:28.450", "references": [{"url": "https://github.com/zcaceres/markdownify-mcp/", "source": "cna@vuldb.com"}, {"url": "https://github.com/zcaceres/markdownify-mcp/issues/110", "source": "cna@vuldb.com"}, {"url": "https://github.com/zcaceres/markdownify-mcp/pull/111", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-14702", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/846942", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/376298", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/376298/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-310"}, {"lang": "en", "value": "CWE-330"}]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile of the file src/Markdownify.ts of the component webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. This manipulation causes insufficiently random values. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en zcaceres markdownify-mcp hasta la versi\u00f3n 1.1.0. Esto afecta a la funci\u00f3n saveToTempFile del archivo src/Markdownify.ts del componente webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. Esta manipulaci\u00f3n causa valores insuficientemente aleatorios. El ataque est\u00e1 restringido a la ejecuci\u00f3n local. Se necesita un alto grado de complejidad para el ataque. Se dice que la explotabilidad es dif\u00edcil. El exploit ha sido publicado y puede ser utilizado. La pull request para solucionar este problema espera ser aceptada."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "cna@vuldb.com"}