Threat Intelligence Database

CVE-2026-104634 is an incorrect type conversion vulnerability in the BeamMCP.Server component of ScriptKittyOS beam_mcp. It causes boolean values true, false, and null from an MCP client to be converted into strings "true", "false", and "nil" when passed to the host's dispatch function. This leads to logic errors where boolean checks behave incorrectly, potentially causing false to be treated as true. The issue affects beam_mcp versions from 0.1.0 up to but not including 0.10.1.

Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (items, minItems, maxItems, minLength, maxLength, pattern, nested required, enum and additionalProperties: false) were advertised by tools/list and never checked at tools/call or prompts/get, and keywords outside the enforced subset (oneOf, anyOf, $ref) were advertised and ignored. A host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact. This issue affects beam_mcp: from 0.1.0 before 0.10.1.