CVSS 10.0 flaw in IBM mcp-context-forge lets unauthenticated sandbox escape via getattr

·1 views

IBM's mcp-context-forge, an MCP gateway, contains a sandbox component intended to safely run untrusted code, but CVE-2026-53710 defeats it. The sandbox's safe_builtins dictionary exposes a raw getattr reference, which lets executed code traverse Python object attributes to reach subprocess.Popen and launch processes outside the sandbox. The execute_code endpoint is reachable over HTTP and SSE without authentication, and the flaw carries a CVSS base score of 10.0. Versions before 1.0.2 are affected, and users are advised to upgrade and restrict network exposure of the service.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Liquid AI Unveils LFM2.5-24B-A2B for Fast On-Device Agents

Liquid AI has introduced LFM2.5-24B-A2B, a new model positioned for building fast AI agents that run directly on local devices. The announcement was published on the company's blog and drew attention on Hacker News, where it gathered 17 points and one comment. The model is aimed at developers who need responsive agent performance without relying on cloud-based inference. The source material provides limited technical detail beyond this positioning, so specifics about benchmarks or architecture are not covered here.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Open-source Rust service wrapper runs Java apps on Windows, Mac and Linux

A new MIT-licensed Java service wrapper has been released on GitHub under the theonedev project, written in Rust. It has been tested intensively on Windows and Linux (amd64 and arm64) as well as Mac Silicon. OneDev uses the wrapper to run its Java application as a service on these platforms. Its configuration is a subset of the Java Service Wrapper (JSW), focusing solely on service wrapping and omitting JVM monitoring.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

BillCraft AI: Privacy-First Invoice Generator and Receipt Reader for Freelancers

BillCraft AI is an open-source invoice tool aimed at freelancers, contractors, and small business owners who want to avoid manual bookkeeping. It offers an invoice generator with saved business profiles, automatic totals, AI-assisted item descriptions, and branded PDF export. A companion reader uses local OCR and the open-weight Qwen 2.5 7B model to extract line items from receipts and PDFs, then checks the math on the server. The developers say the design keeps financial data off third-party cloud servers and contrasts it with subscription-based SaaS accounting tools costing $30 to $70 per month. The project was built for the Hacktoberfest Open-Source AI Challenge and is available as a live web app and on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Guide Outlines Backend Exception Tracking for Express Pricing Rule Rollouts

A technical guide describes how a small Node.js Express service should capture backend exceptions while rolling out a property-pricing rule. It recommends attaching release, environment, request context, and privacy-reviewed identifiers at the Express error boundary, and triaging by error group rather than paging on every event. The author argues that silent failures, such as scheduled rollouts that never start, need separate heartbeat and counter monitoring beyond exception capture. The piece also presents a runnable Go transport that posts validated error events with key-based authentication, bounded retries, Retry-After handling, and exponential backoff. It notes that the Infrai provider lacks alert routing, source-map decoding, session replay, trace queries, and heartbeat monitoring, so those tasks must be assigned elsewhere.

0 comments Read more at DEV Community