CVE-2026-104634: CWE-704 Incorrect Type Conversion or Cast in ScriptKittyOS beam_mcp

The vulnerability arises because BeamMCP.Schema.validate/2 accepts a value as boolean, but subsequent processing via normalize_arguments/2 and to_json_value/1 converts true, false, and nil atoms into their string equivalents. Since strings are truthy in Elixir, boolean logic on these arguments can be inverted, causing hosts to take incorrect branches in code that depends on boolean flags. The client controls these arguments, so the impact depends on host behavior differences between true and false. This affects beam_mcp versions >=0.1.0 and <0.10.1.

The impact is limited to hosts whose behavior differs between true and false boolean arguments. Because false is converted to a truthy string, logic that expects false may incorrectly execute the true branch, potentially bypassing intended controls or causing unintended actions. The vulnerability also affects any policy layers that distinguish between true and false values. However, the practical impact is low given the limited scope and the CVSS score of 2.3.

No official patch or fix is indicated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should review host logic that depends on boolean arguments from MCP clients and consider additional validation or normalization to correctly handle boolean values.