CVE-2026-14702

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14702
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14702.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14702
Published
2026-07-05T04:00:08.361Z
Modified
2026-07-15T01:48:53.409283780Z
Severity
  • 1.1 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values
Details

A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile of the file src/Markdownify.ts of the component webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. This manipulation causes insufficiently random values. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

Database specific 
{
    "cwe_ids": [
        "CWE-310",
        "CWE-330"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14702.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0"
                },
                {
                    "last_affected": "1.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/zcaceres/markdownify-mcp

Affected ranges

Type
GIT
Repo
https://github.com/zcaceres/markdownify-mcp
Events
Introduced
024f97cea9a94cd842c445eea4503c442c79bd71
Last affected
024f97cea9a94cd842c445eea4503c442c79bd71
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.1.0"
        },
        {
            "last_affected": "1.1.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.1.0
v1.*
v1.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14702.json"