PT-2026-50471 · Npm · Chrome-Devtools-Mcp
Published
2026-06-17
·
Updated
2026-06-18
·
CVE-2026-53765
CVSS v3.1
6.1
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
chrome-devtools-mcp (affected versions not specified)
Description
On POSIX systems, specifically macOS and Linux sessions where the
XDG RUNTIME DIR environment variable is unset, the daemon writes its PID file to a deterministic path in /tmp using the fs.writeFileSync() function. Because this operation does not use the O NOFOLLOW flag, a local low-privilege user can pre-create the PID file path as a symbolic link pointing to any file the victim has permission to write. When the victim starts the daemon, the process follows the symlink and truncates the target file, overwriting its content with the daemon PID string. This can lead to the corruption of critical files such as ~/.ssh/authorized keys, shell configuration files like ~/.bashrc, or project secrets.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Link Following
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Chrome-Devtools-Mcp