How the attack works
An attacker (or a compromised agent workflow) calls the get-markdown-file tool on a markdownify server. Instead of a normal document path, the path argument contains either a directory-traversal sequence (like repeated '../' or its percent-encoded form) or an absolute path to a sensitive location such as a credentials file, SSH key, or process memory. Because the server does not canonicalise or restrict the path to a workspace, it opens and converts whatever file is named. The attacker receives the file's contents rendered as markdown, effectively exfiltrating it through a document-conversion feature.
Why it matters
An organisation can lose confidentiality of secrets, credentials, private keys, or other sensitive files that were never meant to be exposed to the tool-calling agent or its operator, with no authentication barrier in the vulnerable versions.
What you can do
- Upgrade mcp-markdownify-server to 1.0.0 or later, or apply path canonicalisation and workspace containment yourself if running an older version.
- Restrict which file paths the markdownify tool can access, ideally via an allowlist scoped to a documentation directory.
- Review logs for get-markdown-file / get_markdown_file calls containing '../' sequences, percent-encoded traversal, or absolute paths to credential or memory locations.
- Treat any legitimate need to convert files outside the workspace root as an exception requiring explicit approval, not routine tool behaviour.
Known benign look-alikes
- Authorised red-team or CVE-validation runs against a deliberately vulnerable mcp-markdownify-server instance; the arguments are indistinguishable from a real exploit and this rule will fire, which is the intended behaviour during testing.
- A documentation pipeline that legitimately converts a file two or more directory levels above the workspace root (e.g. a monorepo packaging step passing "../../shared/README.md"). This matches sel_traversal only; it does not touch a credential target, and the report verdict leaves the conversion unaffected.
- An operator intentionally converting an infrastructure config file that happens to live under a dotfile directory (for example rendering a committed ".aws/config" sample into markdown for a runbook).
- A markdown source file whose name ends in ".key" or ".env" by local convention; the pattern requires the extension to terminate the JSON string value, so ".env.md" and "secrets.key.md" do not match.