langbot (>=4.4.1b1, <=4.10.6), lbp (>=0.1.1, <=0.1.2) potentially affected by CVE-2026-90938 via langbot-plugin (>=0.1.1b1, <=0.4.13)

langbot-plugin PYPI version =0.1.1b1, =4.4.1b1, =0.1.1, =0.1.2 Source cves: CVE-2026-90938 Source advisory: MEND:CVE-2026-90938...

PT-2026-91214

LangBot's plugin runtime pip package langbot plugin through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 /plugin/ws whose authentication is gated on plugin debug key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose which...