Threats affecting pkg:brew/pieces-cli

The Model Context Protocol (MCP) Python SDK versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where the client fetches server-chosen external $ref URLs during tool output schema validation. This can cause the client to make network or local file requests synchronously without timeout, potentially freezing the client session. The issue is fixed in versions 1.30.0 and 2.2.0, which restrict reference resolution to within the schema document only.

The Model Context Protocol (MCP) Python SDK versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where HTTP client transports follow cross-origin redirects and send custom headers and, on certain redirects, the request body to the redirected host. This behavior can expose sensitive headers such as API keys if an attacker can cause a trusted endpoint to redirect to a malicious host. The SDK now restricts redirects to same-origin only in versions 1.30.0 and 2.2.0 and later.

This update for python-starlette fixes the following issues - CVE-2025-54121: denial-of-service when parsing a multi-part form with large files (bsc#1246855). - CVE-2025-62727: DoS via Range header merging (bsc#1252805). - CVE-2026-48710: Missing Host header validation poisons request.url.path, bypassing path-based security checks (bsc#1266369).