EUVD-2026-65737

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

CVE-2026-45018 Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

CVE-2026-45018

Chainlit (Python framework for conversational AI applications) is vulnerable to command injection via its MCP stdio transport in versions 2.4.0rc0 through 2.12.0 . When features.mcp.enabled is set to true, the POST /mcp endpoint is exposed without authentication . The validate_mcp_command() funct...

mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

mcp-shell at commit 17ac0eef5c9a5a42b8fb132d3d034973d55a5433 has two issues that together mean neither the default deploy path nor the recommended "secure mode" delivers the restriction they're marketed as providing. Filing these together because the two failure modes bracket the full intended...

CVE-2026-55580 mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and when MCPSHELLSECCONFIGFILE is unset, main.go starts the documented bare-binary deployment without a security policy...

CVE-2026-55580 mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and when MCPSHELLSECCONFIGFILE is unset, main.go starts the documented bare-binary deployment without a security policy...

CVE-2026-62674 Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/sessionid/agent checks LEVELEDIT permission for a session but does not reject a bound shared or template agent whose agent.sessionid is None. An authenticated user with ed...

CVE-2026-62674: Improper Control of Generation of Code

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/sessionid/agent checks LEVELEDIT permission for a session but does not reject a bound shared or template agent whose agent.sessionid is None. An authenticated user with ed...

CVE-2026-54449

In LangBot 4.10.7 and earlier, StdioServerParameters in src/langbot/pkg/provider/tools/loaders/mcp.py runs attacker-supplied commands as a server-side subprocess without authorization checks (CWE-78). Any authenticated user can add an arbitrary command via the Extensions MCP tab, achieving full R...

IBM Langflow OSS command injection vulnerability

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications through drag-and-drop components. Additionally, it supports deep customization using Python to integrate...

CVE-2026-12940

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

CVE-2026-12940

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

CVE-2026-12940

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

Summary An unauthenticated remote attacker can force any MCP Ruby SDK server using MCP::Server::Transports::StreamableHTTPTransport to allocate gigabytes of memory by sending a single oversized JSON-RPC POST. The transport reads the entire HTTP body into a Ruby String and parses it with...

EUVD-2026-50500

MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion DoS...

MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

Summary The stdio transports in MCP::Server::Transports::StdioTransport and MCP::Client::Stdio read newline-delimited JSON-RPC frames using IOgets with no limit argument. CRuby's IOgets with no limit reads from the current position until the next separator \n with no upper bound on the returned...

CVE-2026-63119 MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client::Stdio in the mcp gem use IOgets without a byte limit, allowing a peer that sends data without a newline to exhaust process memory. This...

CVE-2026-63119 MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client::Stdio in the mcp gem use IOgets without a byte limit, allowing a peer that sends data without a newline to exhaust process memory. This...

CVE-2026-63119 MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client::Stdio in the mcp gem use IOgets without a byte limit, allowing a peer that sends data without a newline to exhaust process memory. This...

CVE-2026-63119

The CVE affects the MCP Ruby SDK (mcp gem), specifically MCP::Server::Transports::StdioTransport and MCP::Client::Stdio. The vulnerability arises from using IO#gets without a byte limit, allowing an attacker to send data without a newline and trigger unbounded line buffering, causing memory exhau...