{"data":{"id":"074f2cab-91c9-4279-ad1b-2b9a57c82e49","title":"GHSA-3pvh-63gf-j9mw: LangBot: Authenticated RCE Via MCP Configuration","summary":"Any authenticated LangBot user can execute arbitrary OS commands on the server by adding an STDIO MCP server with a chosen command in the MCP configuration. The flaw is in src/langbot/pkg/provider/tools/loaders/mcp.py, where StdioServerParameters from the mcp package spawns a subprocess with the supplied command. The advisory rates this as authenticated remote code execution (CWE-78) affecting publicly reachable instances and, from the same network, local instances.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-3pvh-63gf-j9mw","publishedAt":"2026-07-15T17:39:34.000Z","cveId":"CVE-2026-54449","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langbot@<= 4.10.5"],"affectedPackageNames":["langbot"],"affectedPackageRefs":["pypi:langbot"],"affectedVendors":[],"affectedVendorsRaw":["LangBot","MCP","Anthropic modelcontextprotocol"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00721,"epssCheckedAt":"2026-10-14T18:05:59.662Z","kevDateAdded":null,"advisoryAliases":["GHSA-3pvh-63gf-j9mw"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-07-15T17:39:34.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}