Developer fixes mcpscan tool after four 2026 MCP server CVEs exposed write-path blind spot

·1 views

Security developer Ayush identified a critical gap in mcpscan, his open-source static analyzer for Model Context Protocol servers, after discovering it would have missed all four path-traversal CVEs disclosed against MCP servers in 2026. The vulnerabilities affected excel-mcp-server, appium-mcp-server, PraisonAI, and mcp-atlassian, all sharing the same root cause of unvalidated caller-controlled file paths on write operations. The most severe flaw, CVE-2026-27825 in mcp-atlassian, carried a CVSS score of 9.1 and enabled unauthenticated remote code execution by chaining a path traversal with an SSRF vulnerability to overwrite sensitive system files. The scanner's existing rule MCP007 was scoped only to file-read sinks, leaving write operations such as write_text, write_bytes, and shutil.copy entirely undetected. The fix adds a dedicated write-sink regex layer to the existing detection pipeline, extending coverage without altering the tool's lightweight, AST-free architecture.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How AI Agents Can Generate Structured, Actionable Meeting Records

AI agents can convert raw meeting transcripts into structured follow-up documents that go beyond simple summaries, capturing decisions, action items, open questions, and unresolved details. A useful meeting record answers the questions people ask after a meeting ends — what was decided, who is responsible, and by when — rather than merely describing what was discussed. The output is most reliable when requests are specific, including meeting goals, attendee names, agenda topics, and technical terms that transcription tools may misinterpret. Each category of information serves a distinct purpose: decisions must be stated as facts, action items need a clear owner and deadline, and uncertain details should be flagged to prevent planning errors. A human review before distribution remains essential, as AI-generated summaries can occasionally misrepresent key decisions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Launches Free, No-Login AI Font Identifier Powered by Edge Computing

A developer has built and released Font Finder AI, a free font identification tool designed to address the paywalls, slow load times, and ad clutter found in legacy tools like WhatTheFont. The tool accepts PNG, JPG, WebP, and clipboard-pasted images, then uses edge-based neural matching and OCR to identify fonts in under two seconds without requiring any registration. Rather than prioritizing expensive commercial typefaces, it maps results to freely available Google Fonts and open-source alternatives, making implementation straightforward for web developers. The tool also includes a Brazilian Portuguese interface to support design communities across Latin America. Font Finder AI is currently live and open for public feedback on serif and sans-serif classification accuracy.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS RDS Deep Dive: Architecture, High Availability, and SRE Best Practices

Amazon RDS is a fully managed AWS database service supporting engines such as PostgreSQL, MySQL, MariaDB, Oracle, SQL Server, and Aurora, designed to eliminate the operational burden of self-managed database clusters. Its Multi-AZ deployment model provisions a primary node and a warm standby across separate Availability Zones, using synchronous block-level writes to guarantee zero data loss and automatic DNS-based failover within 60–120 seconds. Up to 15 read replicas can be provisioned to offload analytics and reporting workloads, though asynchronous replication introduces a small lag that requires latency-sensitive reads to target the primary endpoint. Amazon Aurora enhances this architecture by decoupling compute from a distributed storage layer and using a 4-of-6 quorum write model across three Availability Zones, reducing network overhead and failover time. RDS Proxy sits between client applications and the database engine, pooling connections to prevent resource exhaustion and further cutting Multi-AZ failover time by up to 66%.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Fixes Missing Citation Bug in Gemini 3.8 Flash AI Mode Search

Google resolved a bug that caused AI Mode search responses powered by Gemini 3.8 Flash to display without citation links or source references. The issue surfaced shortly after Google launched Gemini 3.8 Flash on September 2, 2026, for AI Pro and Ultra subscribers across the Gemini app, AI Mode, and Google Sheets. Google VP of Search Product Robby Stein publicly confirmed the behavior was unintended and pledged a prompt fix. By September 4, 2026, industry observers and follow-up reports noted that source links had begun reappearing in AI Mode answers for many queries. The incident highlighted the importance of citations in AI-assisted search, as source links allow users and businesses to verify, contextualize, and build on AI-generated responses.

0 comments Read more at DEV Community