Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• high

  mcp-contextforge-gateway Server-Side Template Injection (SSTI) leading to RCE

  An attacker with API access to mcp-contextforge-gateway can store a malicious Jinja2 template as a prompt, which executes arbitrary OS commands on the server when the prompt is later rendered.

• high

  CVE-2026-9769: justhtml Uncontrolled Recursion DoS via Deeply Nested HTML

  Passing roughly 1000 nested HTML tags to the justhtml parser crashes the Python process with an unhandled RecursionError, letting any attacker who can supply HTML input take down a server worker.

• highCVE-2026-55596

  CVE-2026-55596: @platejs/media Media Embed Stored XSS via Serialized Provider Metadata

  A crafted Plate document can smuggle a javascript: URL into a media embed iframe by setting a trusted provider name in serialized node metadata, bypassing the URL sanitization that normally blocks…

• highCVE-2026-55677

  CVE-2026-55677: Echo v5 Encoded Slash Route-Bypass Exposes Static Files

  Sending %2F instead of / in a URL tricks Echo's router into skipping auth middleware while the static file handler still decodes and serves the protected file.

• highCVE-2026-55553

  CVE-2026-55553: urllib Cross-Origin Redirect Credential Leakage

  When urllib follows an HTTP redirect to a different origin, it sends credential headers like Authorization and Cookie to the new destination unchanged, handing those secrets to whoever controls the…

• highCVE-2026-55585

  CVE-2026-55585: qwed Authenticated Remote Code Execution via Unsafe SymPy parse_expr()

  Any user with a free account on a qwed server can run arbitrary operating-system commands inside the API process by sending a crafted math expression, because the expression is passed straight to…

• high

  utcp-http SSRF via Unvalidated HTTP Redirect in call_tool

  The utcp-http library validates a tool's URL before making a request but then follows redirects blindly, letting an attacker's server bounce the HTTP client into internal services like the cloud…

• highCVE-2026-55571

  CVE-2026-55571: djust LiveView WebSocket Authentication Bypass

  A flaw in djust's LiveView WebSocket consumer lets an unauthenticated attacker skip a login redirect and call protected server-side event handlers, bypassing all access controls on gated views.

• high

  utcp-http OAuth2 tokenUrl Trust Boundary Bypass (SSRF and Credential Theft)

  The utcp-http library blindly trusts a tokenUrl embedded in any remote OpenAPI spec, letting an attacker intercept OAuth2 client credentials or redirect token requests to internal network services.

• high

  pickem Terminal Escape-Sequence Injection via Unsanitized Item Labels

  The pickem npm package printed user-supplied choice labels directly to the terminal without stripping control characters, letting an attacker embed sequences that silently hijack the clipboard or…

• criticalCVE-2026-55640

  CVE-2026-55640: nextcloud-mcp-server Unauthenticated Webhook Allows Arbitrary Vector Data Deletion

  Any unauthenticated attacker who can reach port 8000 can send a crafted POST to the Nextcloud webhook endpoint and delete any user's semantic search index in Qdrant, because the server ships with no…

• highCVE-2026-55582

  CVE-2026-55582: mcp-shell Secure Mode Allowlist Bypass via Git Shell Alias

  mcp-shell's secure mode can be completely bypassed by passing a Git command with a shell alias argument, letting any MCP client run arbitrary OS commands even when the allowlist is active.