AdvisoriesToolsStatsChecklistSubmitGet the email
← All issues
The weekly email · 2026-11-05

Langflow needs another upgrade, MoLing lets any web page in, and Claude Code on macOS

31 new entries this week, from IBM's Langflow bulletins to MCP servers that skip auth. Here's what to check.

We added 31 new entries to VibeVulns this week, which brings the total to 214. The ones that need attention first are below.

Langflow: keep upgrading, IBM keeps finding more

Critical. Three IBM Langflow OSS bulletins landed in the last couple of weeks. The newest (bulletin 7294467) covers Langflow through 1.12.8: an unauthenticated authentication bypass and unauthenticated code execution, both rated 9.8, plus a low-privilege path to OS commands and a credential leak. Fix is 1.13.0, so even instances you patched to 1.12.5 last week need another upgrade.

The earlier bulletins cover unauthenticated RCE and a long list of code execution, SSRF and path-traversal bugs in 1.12.3 through 1.12.5. Same advice: go straight to 1.13.0.

1.13.0 bulletin · 1.12.4 / 1.12.5 roll-up · 1.12.3 roll-up

MoLing: any web page can drive the computer-use MCP

Critical. MoLing's SSE mode before 0.5.0 doesn't authenticate /sse and /message, and its mcp-go dependency sends Access-Control-Allow-Origin: *. A page you visit can grab a session id and send tool calls that read or write files or run commands, even when MoLing only listens on loopback. Upgrade to 0.5.0.

How to check and fix it

TAKO for Okta: first-run admin takeover and root Python

Critical. TAKO (okta-ai-agent) before 3.0.1-beta lets anyone who can reach port 8001 on a fresh install create the first admin account, and any logged-in user can slip Python past the code validator and run it as root in the default container. That exposes Okta API tokens and the JWT key. Upgrade to 3.0.1-beta.

How to check and fix it

Decepticon: forged operator turns from a web page

Critical. Before 1.1.17, Decepticon put crawled page text into LLM messages without stripping ChatML special tokens. Text planted on a target page can forge a new operator turn, bypass the agent's guardrails and run commands in its Kali sandbox when you use a self-hosted OpenAI-compatible backend that keeps those tokens. Upgrade to 1.1.17.

How to check and fix it

Claude Code Edit tool on macOS

High. Before 2.1.251, Claude Code's Edit tool checked its target path once and then wrote without tying that check to the real directory. Code running inside the Bash sandbox could swap a workspace folder for a symlink right after the check, so the unsandboxed Edit tool overwrote a user-writable file outside the workspace. Fixed in 2.1.251.

How to check and fix it

MCP TypeScript SDK 1.32

High. Four more advisories for @modelcontextprotocol/sdk, fixed in 1.32.0 (and the 2.3.0 line of the split 2.x packages). One HTTP request can exhaust server memory, the experimental taskStore lets clients read and cancel each other's tasks, bearer auth accepted tokens issued for other services, and HTTP clients followed cross-origin redirects with API keys and OAuth secrets still attached. For two of these, upgrading alone changes nothing: you also have to turn new options on.

How to check and fix it

MLflow ZDI batch

High. Trend Micro's Zero Day Initiative published six MLflow advisories fixed in 3.17.0: an unauthenticated SSRF in get-artifacts, two unsafe-deserialization paths to code execution (SHAP / pickle artifacts), and three missing Tracking Server permission checks. If you already jumped to 3.17.0 for last week's scorer RCE, you're covered; if not, this is another reason to.

How to check and fix it

vLLM, RAGFlow and Pydantic AI

More MCP servers and agent tools

Plenty of MCP and agent-tool fixes this week. The ones that stand out:

n8n, Flowise, Agno, LangGraph and the rest

Found something we missed? Send it in. Every entry needs a public source.