Dashboard / CVE-2026-14702

CVE-2026-14702

LOW
INFO Priority: 0.00 BB Relevance: 27/100
Published: 2026-07-05 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Interaction

CVSS Vector Breakdown

AV: Local
AC: High
PR: Low
UI: None
S: X
AT: None
VC: Low
VI: None
VA: None

Description

A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile of the file src/Markdownify.ts of the component webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. This manipulation causes insufficiently random values. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

Weakness Classification (2)

References & Advisories (7)

Bug Bounty Relevance

27 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

1.1 / 10.0 v4.0
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.14%
Raw Score 0.001440
Percentile 3.7%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00144
2026-10-28
0.00144

Intelligence Sources

nvd ref →

External Links