CVE-2026-53766

### Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an unfixed security issue. `McpContext.validatePath()` enforces workspace `roots` by checking whether `path.resolve(filePath)` textually falls under one of the configured root paths. `path.resolve()` does not canonicalize symbolic links. As a result, a symlink inside a configured workspace root can point to a file outside that root, pass validation, and then be followed by downstream file read/write operations. This bypass applies even when the MCP client correctly declares the `roots` capability with a non-empty list. It is separate from the documented legacy behavior where missing `roots` capability allows all paths. The practical impact is a workspace-boundary bypass. In the write direction, filePath-writing tools can overwrite out-of-root files through an in-root symlink. In the read direction, `upload_file` can read through the symlink and send the file to the currently selected web page. ### Details Affected code: `src/McpContext.ts:178-199` ```ts validatePath(filePath?: string): void { if (filePath === undefined) { return; } const roots = this.roots(); if (roots === undefined) { return; } const absolutePath = path.resolve(filePath); for (const root of roots) { const rootPath = path.resolve(fileURLToPath(root.uri)); if ( absolutePath === rootPath || absolutePath.startsWith(rootPath + path.sep) ) { return; } } throw new Error( `Access denied: path ${filePath} is not within any of the workspace roots ${JSON.stringify(roots)}.`, ); } ``` `path.resolve()` only normalizes path text such as `.` and `..`. It does not call `realpath()` and does not resolve symlinks. Therefore, a path like: ```text /worksp