{"action":"Upgrade chrome-devtools-mcp to 1.1.0 or later.","affected":[{"fixed":"1.1.0","introduced":"0.24.0"}],"component":"chrome-devtools-mcp","cve_ids":["CVE-2026-53766"],"ecosystem":"npm","epss":0.00117,"exploited":false,"fixed_versions":["1.1.0"],"ghsa_id":"GHSA-8qf9-62x2-82pp","id":"tcs_01M5KFDQX6PF7W4N4MQ65CF2YD","modified_at":"2026-08-17T22:00:07.057625756Z","published_at":"2026-08-17T21:56:12Z","references":["https://osv.dev/vulnerability/GHSA-8qf9-62x2-82pp","https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-8qf9-62x2-82pp","https://nvd.nist.gov/vuln/detail/CVE-2026-53766","https://github.com/ChromeDevTools/chrome-devtools-mcp/pull/2127","https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/176eb695137d9c46a61e2d4d5571880c5145cf46","https://github.com/ChromeDevTools/chrome-devtools-mcp","https://github.com/ChromeDevTools/chrome-devtools-mcp/releases/tag/chrome-devtools-mcp-v1.1.0"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-8qf9-62x2-82pp","url":"https://osv.dev/vulnerability/GHSA-8qf9-62x2-82pp"}],"summary":"chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots"}