CVE-2026-53766

npm/chrome-devtools-mcp CVE-2026-53766: medium 6.1

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

Action: Upgrade chrome-devtools-mcp to 1.1.0 or later.

npm i chrome-devtools-mcp@1.1.0

Affected

Fixed versions

Sources

• osv: GHSA-8qf9-62x2-82pp
• https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-8qf9-62x2-82pp
• https://nvd.nist.gov/vuln/detail/CVE-2026-53766
• https://github.com/ChromeDevTools/chrome-devtools-mcp/pull/2127
• https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/176eb695137d9c46a61e2d4d5571880c5145cf46
• https://github.com/ChromeDevTools/chrome-devtools-mcp
• https://github.com/ChromeDevTools/chrome-devtools-mcp/releases/tag/chrome-devtools-mcp-v1.1.0

CVE-2026-53766 · published 2026-08-17T21:56:12Z · modified 2026-08-17T22:00:07.057625756Z · JSON