HighVulnerability
GHSA-3pvh-63gf-j9mw: LangBot: Authenticated RCE Via MCP Configuration
- Identifiers
- CVE-2026-54449GHSA-3pvh-63gf-j9mw
- Published
- Record updated
- Affected
- langbot <= 4.10.5
- Fixed in
- No fixed version was stated when the source was last read.
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.7%
Summary
Any authenticated LangBot user can execute arbitrary OS commands on the server by adding an STDIO MCP server with a chosen command in the MCP configuration. The flaw is in src/langbot/pkg/provider/tools/loaders/mcp.py, where StdioServerParameters from the mcp package spawns a subprocess with the supplied command. The advisory rates this as authenticated remote code execution (CWE-78) affecting publicly reachable instances and, from the same network, local instances.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Topics
Related items
- LowFBI arrests Saudi OpenAI employee who allegedly planted recording device in conference roomSimilar attack · CNBC Technology
- MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
- LowAnthropic warns self-replicating AI could spread to your smart devicesSimilar attack · BleepingComputer
- InfoAnthropic Warns Small AI Models Could Soon Form Self-Propagating IoT BotnetsSimilar attack · The Hacker News
- InfoAgent Baseline Publishes Security Reference Architecture for Software FactoriesSimilar attack · Socket Blog