CVE-2026-76892

The tsParticles TypeScript library (specifically the @tsparticles/mcp-server component) is vulnerable to a Denial of Service (DoS) condition in versions prior to 4.3.1 . The root cause is that the POST /mcp handler calls JSON.parse outside of a request-local error boundary in integrations/mcp-ser...

CVE-2026-76826

The tsParticles TypeScript library (versions 4.0.0 through 4.3.2 ) is vulnerable to OS Command Injection (CWE-78) within its stable publish workflow. The vulnerability occurs because the workflow interpolates steps.release.outputs.body directly into a Bash echo command when generating RAW_RELEASE...

CVE-2026-76893

The tsParticles TypeScript library (specifically the @tsparticles/mcp-server component) is vulnerable in versions prior to 4.3.2 . Due to a flaw in the HTTP mode , the server reuses a single stateful StreamableHTTPServerTransport for all clients. An unauthenticated client can claim this shared st...

CVE-2026-63655

The tsParticles TypeScript library (specifically the @tsparticles/mcp-server component) is vulnerable to a Denial of Service (DoS) attack in versions prior to 4.3.1 . The vulnerability exists because the HTTP mode accepts unauthenticated POST /mcp requests and accumulates request-body chunks into...