chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

CVE-2026-53766 · Published Aug 17, 2026

Medium6.1

Fix: upgrade to 1.1.0 or later

Summary

I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an unfixed security issue.

McpContext.validatePath() enforces workspace roots by checking whether path.resolve(filePath) textually falls under one of the configured root paths. path.resolve() does not canonicalize symbolic links. As a result, a symlink inside a configured workspace root can point to a file outside that root, pass validation, and then be followed by downstream file read/write operations.

This bypass applies even when the MCP client correctly declares the roots capability with a non-empty list. It is separate from the documented legacy behavior where missing roots capability allows all paths.

The practical impact is a workspace-boundary bypass. In the write direction, filePath-writing tools can overwrite out-of-root files through an in-root symlink. In the read direction, upload_file can read through the symlink and send the file to the currently selected web page.

Details

Affected code:

src/McpContext.ts:178-199

```ts

validatePath(filePath?: string): void {

if (filePath === undefined) {

return;

}

const roots = this.roots();

if (roots...

Affected versions

Package	Affected	Fixed in
chrome-devtools-mcp npm	>= 0.24.0, < 1.1.0	1.1.0

Details and references

### Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an unfixed security issue. `McpContext.validatePath()` enforces workspace `roots` by checking whether `path.resolve(filePath)` textually falls under one of the configured root paths. `path.resolve()` does not canonicalize symbolic links. As a result, a symlink inside a configured workspace root can point to a file outside that root, pass validation, and then be followed by downstream file read/write operations. This bypass applies even when the MCP client correctly declares the `roots` capability with a non-empty list. It is separate from the documented legacy behavior where missing `roots` capability allows all paths. The practical impact is a workspace-boundary bypass. In the write direction, filePath-writing tools can overwrite out-of-root files through an in-root symlink. In the read direction, `upload_file` can read through the symlink and send the file to the currently selected web page. ### Details Affected code: `src/McpContext.ts:178-199` ```ts validatePath(filePath?: string): void { if (filePath === undefined) { return; } const roots = this.roots(); if (roots === undefined) { return; } const absolutePath = path.resolve(filePath); for (const root of roots) { const rootPath = path.resolve(fileURLToPath(root.uri)); if ( absolutePath === rootPath || absolutePath.startsWith(rootPath + path.sep) ) { return; } } throw new Error( `Access denied: path ${filePath} is not within any of the workspace roots ${JSON.stringify(roots)}.`, ); } ``` `path.resolve()` only normalizes path text such as `.` and `..`. It does not call `realpath()` and does not resolve symlinks. Therefore, a path like: ```text /workspace/project/cache/profile ``` can textually pass the `/workspace` prefix check even when `cache/profile` is a symlink to: ```text /home/user/.aws/credentials ``` Downstream consumers then perform real filesystem operations without `O_NOFOLLOW`: - `src/McpContext.ts:720-738` `saveFile()` uses `fs.mkdir({recursive: true})` and `fs.writeFile()`. - `src/tools/input.ts:454-497` `upload_file` calls `puppeteer.uploadFile(filePath)` or `fileChooser.accept([filePath])`. - Other filePath-writing tools include screenshots, heap snapshots, network response save paths, snapshots, screencasts, Lighthouse output, and performance trace saves. This is not a TOCTOU/race condition. The symlink exists before validation and the PoC uses a single process. The issue is a canonicalization bypass / improper link resolution. Preconditions: - The MCP client declares `roots` and supplies at least one workspace root. - A symlink exists inside the workspace and points outside the workspace. - For the remote prompt-injection chain, the user processes untrusted page content while chrome-devtools-mcp is connected. A remote attacker does not need local access if a suitable workspace-internal symlink already exists, or if another trusted tool/workflow can create it. Without such a symlink, the issue is a local/workspace-state-dependent boundary bypass. ### PoC Conceptual exploitation with a configured root: ```text Configured roots: file:///workspace Workspace path: /workspace/project/cache/profile -> /home/user/.aws/credentials Tool call: upload_file({ filePath: "/workspace/project/cache/profile", uid: "<file input element on current page>" }) Result: validatePath() accepts the path because it textually starts with /workspace. Puppeteer follows the symlink and uploads the target file to the page. ``` Lab-only PoC that replicates the exact validation logic and subsequent write. It writes only inside a fresh temporary directory and touches no system paths: ```js con

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Severity from: GitHub (reviewed advisory)
Weakness: CWE-22, CWE-59
Also known as: CVE-2026-53766

More chrome-devtools-mcp advisories

All chrome-devtools-mcp

Medium 6.1Jun 17

Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directoryCVE-2026-53765fixed in 1.1.0