Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

The vulnerability of the f_fullcommand function in the Vim text editor, caused by integer overflow, allows a hacker to execute arbitrary code.

The vulnerability of the ffullcommand function in the Vim text editor is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PT-2023-5105

Name of the Vulnerable Software and Affected Versions vim versions prior to 9.0.1846 Description The issue is caused by an integer overflow in the f fullcommand function of the vim text editor. This can allow an attacker to execute arbitrary code. The estimated number of potentially affected...