Advisories

CVE-2026-85787 is an incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server before version 1.1.7. Crafted SQL placed in content submitted by an authenticated user could let an unauthenticated actor modify data beyond the read-only scope. Impacted versions are any PyPI package version below 1.1.7.

CVE-2026-85654 is a code injection flaw in the CDK generator component of Amazon awslabs.dynamodb-mcp-server, an open-source MCP server for DynamoDB. Improper neutralization of special elements in a template engine lets a context-dependent actor run arbitrary code on the host that deploys the generated application, using crafted table, index, or attribute names in a data model file. Impacted versions are >= 2.0.10 AND <= 2.1.5.

CodeWhale's project config merge copies `allow_shell` from a repository's `.codewhale/config.toml` or `.deepseek/config.toml` without the tightening guard applied to `approval_policy` and `sandbox_mode`. A malicious config committed to a repository can silently set `allow_shell = true` for anyone who clones and opens it, exposing the model's `exec_shell` tool and allowing arbitrary shell command execution on the victim's machine without explicit opt-in. The merge at `crates/tui/src/main.rs:5181-5182` (v0.8.50) is applied automatically unless the user passes `--no-project-config`.

The `git_blame` tool in DeepSeek-TUI passes the model-supplied `rev` parameter unvalidated into the argv of `git blame`. A `rev` value of `--contents=/path/to/secret` makes the tool echo the targeted file's contents into the tool result, which returns to the model and appears in the chat transcript, enabling arbitrary file read at the invoking user's privilege. The tool is registered with `ApprovalRequirement::Auto`, so no approval is requested.

The js_execution tool in CodeWhale spawns Node with tokio::process::Command::new without calling env_clear or the child_env scrubber that exec_shell, the Python REPL and the MCP launcher use. Model-provided JavaScript can therefore read process.env, and its output returns to the next model turn, exposing API keys, cloud credentials and forge tokens. With auto_approve enabled (YOLO mode), the JS runs without any prompt, so a prompt injection from a README, web page or MCP output can drain the environment.

CodeWhale's exec_shell_interact tool is marked ApprovalRequirement::Auto, so model-supplied input written to an already-approved interactive shell (such as a python3 -i REPL, mysql, ssh or sudo -i) runs without an approval prompt. Any untrusted content the agent reads can steer that input, giving command execution at the privilege level of the approved process.

CodeWhale's project config merge copies the `instructions` array from a repository's `.codewhale/config.toml` or `.deepseek/config.toml` into the session without path validation. The listed paths are expanded via `expand_path`, read from disk with no workspace boundary check, and injected into the AI system prompt, so a malicious cloned repository can expose files such as `~/.ssh/id_rsa` through the conversation. The advisory notes that the 100KB cap, the `DENY_AT_PROJECT_SCOPE` list and the lack of a tightening guard do not prevent this.

IBM Langflow OSS versions 1.0.0 through 1.11.2 let an authenticated attacker read arbitrary files from the server filesystem. The attacker supplies absolute paths or traversal sequences in the files parameter of a build request, and the file contents are embedded in the language model prompt and sent to the configured model endpoint. The LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true setting was not enforced in the Chat Input to Message attachment pipeline, though it applied to other file-reading components.

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a server-side request forgery flaw, tracked as CVE-2026-19305. A remote attacker can exploit it to obtain sensitive information.

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain CVE-2026-19304. A remote authenticated attacker can exploit a URL parser discrepancy to obtain sensitive information from internal services.

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a flaw caused by improper limitation of a pathname to a restricted directory. A remote authenticated attacker can exploit it to delete arbitrary local files or directories.