The vulnerability in chrome-devtools-mcp involves improper limitation of a pathname to a restricted directory (CWE-22) due to the use of path.resolve() which does not canonicalize symbolic links. The function McpContext.validatePath() checks if a file path is under configured workspace roots by textual comparison after path.resolve(), but symlinks inside the root can point outside, bypassing this check. This allows an attacker to read files outside the workspace via upload_file or overwrite files outside the workspace through filePath-writing tools. This bypass occurs even when the MCP client declares roots capability correctly. The vulnerability affects versions from 0.24.0 until fixed in 1.1.0.

The vulnerability allows an attacker with limited privileges (local access) to bypass workspace boundary restrictions, enabling unauthorized read and write access to files outside the designated workspace roots. This can lead to integrity violations by overwriting files and potential information disclosure by reading arbitrary files. The CVSS score of 6.1 reflects a medium severity with low attack complexity and no user interaction required, but limited to local access with privileges.

This vulnerability is fixed in chrome-devtools-mcp version 1.1.0. Users should upgrade to version 1.1.0 or later to remediate this issue. No other official remediation or temporary fixes are documented. Until upgrading, avoid using symlinks inside workspace roots that point outside the root to prevent bypass.