Threats tagged 'brew-kimi-cli-cve-2026-116686'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.5	EPSS 0.3%	CVE-2026-116686kimi-cli · Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output Medium6.5EPSS 0.3%2026-10-29GCVE DatabaseCVE-2026-116686 The Model Context Protocol (MCP) Python SDK client versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where the client fetches server-chosen $ref URLs during tool output schema validation. This causes the client to synchronously fetch external HTTP, HTTPS, or local file references without timeout, potentially freezing the client session. The issue affects applications using the SDK as a client calling tools on untrusted servers. Fixed in versions 1.30.0 and 2.2.0. EPSS 0.3%Report on CVE-2026-116686 Vulnerability #brew-kimi-cli-cve-2026-116686 #homebrew	GCVE Database	2026-10-29

Page 1 of 1