@blamejs/exceptd-skills 0.13.75 → 0.13.77

package/data/cve-catalog.json

@@ -55,7 +55,7 @@
     "ai_discovery_methodology": {
       "field_added": "2026-05-15",
       "agents_md_target": "Hard Rule #7 — '41% of 2025 zero-days were AI-discovered'. Catalog target rate floor: 0.40.",
-      "current_rate": 0.037,
+      "current_rate": 0.036,
       "current_floor_enforced_by_test": 0.03,
       "ladder_to_target": [
         0.03,
@@ -10010,6 +10010,690 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Tencent WeKnora allows authenticated users to inject commands into MCP stdio settings, causing the server to execute attacker-supplied subprocesses."
   },
+  "CVE-2026-40933": {
+    "name": "FlowiseAI Flowise MCP Custom Config Command Injection",
+    "type": "RCE",
+    "cvss_score": 9.9,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
+    "cvss_note": "NVD/CNA CVSS v3.1 base 9.9 (CRITICAL, Scope:Changed). Authenticated command injection via the Custom MCP configuration.",
+    "cisa_kev": false,
+    "poc_available": true,
+    "poc_description": "Documented in the 2026 MCP supply-chain advisory family (OX Security) and the NVD record: an attacker who controls the MCP Custom configuration causes the host to execute attacker-influenced commands.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Disclosed via the coordinated 2026 MCP supply-chain advisory; the abused surface is the project's MCP command/transport configuration.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No AI-assisted weaponization; conventional command/argument injection through MCP configuration.",
+    "active_exploitation": "none",
+    "active_exploitation_notes": "Research / advisory disclosure; no confirmed in-the-wild exploitation reported as of curation.",
+    "affected": "FlowiseAI Flowise (low-code LLM orchestration builder) versions prior to 3.1.0.",
+    "affected_versions": [
+      "FlowiseAI Flowise < 3.1.0"
+    ],
+    "vector": "Flowise lets an authenticated user define a Custom MCP server configuration whose command/args the server then executes. Sanitization can be bypassed by combining an allow-listed binary (e.g. npx) with execution flags, so the attacker neutralizes special elements (CWE-78) and runs arbitrary OS commands on the Flowise host.",
+    "complexity": "low",
+    "complexity_notes": "NVD AV:N / AC:L: network-reachable, low-complexity command injection through MCP configuration.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "Remediation is an application upgrade to 3.1.0 or later; redeploy, no host reboot.",
+    "vendor_update_paths": [
+      "Upgrade FlowiseAI Flowise to 3.1.0 or later. Until then, restrict who can author Custom MCP configurations and run Flowise as a least-privilege container user."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "Flaw-remediation cadence does not track self-hosted AI agent / RAG frameworks and their MCP command surfaces as managed, RCE-bearing software.",
+      "ISO-27001-2022-A.8.8": "Vulnerability management rarely enumerates an AI framework's MCP command/transport configuration as an in-scope command-execution surface.",
+      "NIS2-Art21-patch-management": "Article 21 measures do not reach MCP command configuration as a privileged execution control plane.",
+      "DORA-Art-9": "ICT protection measures do not model command injection via an AI framework's MCP configuration.",
+      "UK-CAF-B4": "System Security objective has no objective for neutralizing command input handed to an AI framework's MCP transport.",
+      "AU-ISM-1546": "Patch-application control does not single out AI-framework MCP command surfaces.",
+      "ALL-AI-PIPELINE-INTEGRITY": "No framework treats user-supplied MCP command/args as untrusted input requiring neutralization; the transport's by-design command execution turns injection into direct RCE."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 30,
+    "rwep_factors": {
+      "cisa_kev": 0,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 0,
+      "blast_radius": 25,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "Standard (RWEP 30, \"patch within 30 days\" band per lib/scoring.js timeline). Not KEV, no confirmed in-the-wild exploitation, patched at/after disclosure (Hard Rule #3). poc_available=20 (documented technique) + blast_radius=25 minus patch 15.",
+    "epss_score": null,
+    "epss_date": "2026-05-25",
+    "epss_note": "EPSS not pulled for this entry; retrieve via FIRST EPSS API in a future refresh.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-40933",
+    "cwe_refs": [
+      "CWE-78"
+    ],
+    "iocs": {
+      "behavioral": [
+        "Flowise spawning a subprocess whose command/args came from an MCP configuration supplied or influenced by a caller rather than a pinned configuration.",
+        "Shell metacharacters, or allow-listed binaries (npm/npx) carrying execution flags, in MCP command/args values.",
+        "An MCP configuration / management surface reachable by a user who should not control command execution.",
+        "FlowiseAI Flowise < 3.1.0 - the exposed precondition."
+      ],
+      "_ioc_source_note": "Behavioral signatures derived from NVD CVE-2026-40933 (CWE-78 command injection via MCP configuration) and the 2026 MCP supply-chain advisory (https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/) describing the unvalidated-MCP-command class."
+    },
+    "source_verified": "2026-05-25",
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-40933",
+      "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "GitHub Security Advisory",
+        "advisory_id": "CVE-2026-40933",
+        "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c9gw-hvqq-f33r",
+        "severity": "critical",
+        "published_date": "2026-04-21"
+      },
+      {
+        "vendor": "NVD",
+        "advisory_id": "CVE-2026-40933",
+        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40933",
+        "severity": "critical",
+        "published_date": "2026-04-21"
+      }
+    ],
+    "last_updated": "2026-05-25",
+    "discovery_attribution_note": "Imported from NVD (CWE-78; NIST CVSS 9.9) + the 2026 MCP supply-chain advisory family (OX Security). Member of the MCP command-injection class already curated in depth by CVE-2026-22252 and CVE-2026-22688.",
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "FlowiseAI Flowise allows an authenticated user to bypass MCP Custom-config command sanitization (e.g. npx with execution flags) and run arbitrary OS commands on the host."
+  },
+  "CVE-2026-30624": {
+    "name": "Agent Zero MCP Server Config Command Injection",
+    "type": "RCE",
+    "cvss_score": 8.6,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
+    "cvss_note": "NVD CVSS v3.1 base 8.6 (HIGH). Remote code execution through malicious MCP server configurations executed without adequate validation.",
+    "cisa_kev": false,
+    "poc_available": true,
+    "poc_description": "Documented in the 2026 MCP supply-chain advisory family (OX Security) and the NVD record: an attacker who controls the MCP server configuration causes the host to execute attacker-influenced commands.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Disclosed via the coordinated 2026 MCP supply-chain advisory; the abused surface is the project's MCP command/transport configuration.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No AI-assisted weaponization; conventional command/argument injection through MCP configuration.",
+    "active_exploitation": "none",
+    "active_exploitation_notes": "Research / advisory disclosure; no confirmed in-the-wild exploitation reported as of curation.",
+    "affected": "Agent Zero (autonomous agent framework) version 0.9.8.",
+    "affected_versions": [
+      "Agent Zero 0.9.8"
+    ],
+    "vector": "Agent Zero executes MCP server configurations without adequately validating the command/args before spawning the subprocess (CWE-77). An attacker who can supply or influence an MCP server configuration achieves remote code execution on the Agent Zero host.",
+    "complexity": "low",
+    "complexity_notes": "NVD AV:N / AC:L: network-reachable, low-complexity command injection through MCP configuration.",
+    "patch_available": false,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No confirmed fixed release at curation; mitigate by restricting who can configure MCP commands and running the service least-privilege.",
+    "vendor_update_paths": [
+      "Track the Agent Zero project for a fixed release; until one ships, treat MCP server configuration as a privileged surface, restrict who can edit it, and run Agent Zero as a least-privilege user."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "Flaw-remediation cadence does not track self-hosted AI agent / RAG frameworks and their MCP command surfaces as managed, RCE-bearing software.",
+      "ISO-27001-2022-A.8.8": "Vulnerability management rarely enumerates an AI framework's MCP command/transport configuration as an in-scope command-execution surface.",
+      "NIS2-Art21-patch-management": "Article 21 measures do not reach MCP command configuration as a privileged execution control plane.",
+      "DORA-Art-9": "ICT protection measures do not model command injection via an AI framework's MCP configuration.",
+      "UK-CAF-B4": "System Security objective has no objective for neutralizing command input handed to an AI framework's MCP transport.",
+      "AU-ISM-1546": "Patch-application control does not single out AI-framework MCP command surfaces.",
+      "ALL-AI-PIPELINE-INTEGRITY": "No framework treats user-supplied MCP command/args as untrusted input requiring neutralization; the transport's by-design command execution turns injection into direct RCE."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 40,
+    "rwep_factors": {
+      "cisa_kev": 0,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 0,
+      "blast_radius": 20,
+      "patch_available": 0,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "Elevated (RWEP 40, \"patch within 7 days\" band per lib/scoring.js timeline). Not KEV, no confirmed in-the-wild exploitation. poc_available=20 (documented technique) + blast_radius=20.",
+    "epss_score": null,
+    "epss_date": "2026-05-25",
+    "epss_note": "EPSS not pulled for this entry; retrieve via FIRST EPSS API in a future refresh.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-30624",
+    "cwe_refs": [
+      "CWE-77",
+      "CWE-78"
+    ],
+    "iocs": {
+      "behavioral": [
+        "agent-zero spawning a subprocess whose command/args came from an MCP configuration supplied or influenced by a caller rather than a pinned configuration.",
+        "Shell metacharacters, or allow-listed binaries (npm/npx) carrying execution flags, in MCP command/args values.",
+        "An MCP configuration / management surface reachable by a user who should not control command execution.",
+        "Agent Zero 0.9.8 - the exposed precondition."
+      ],
+      "_ioc_source_note": "Behavioral signatures derived from NVD CVE-2026-30624 (CWE-77/CWE-78 command injection via MCP configuration) and the 2026 MCP supply-chain advisory (https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/) describing the unvalidated-MCP-command class."
+    },
+    "source_verified": "2026-05-25",
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-30624",
+      "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "NVD",
+        "advisory_id": "CVE-2026-30624",
+        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30624",
+        "severity": "high",
+        "published_date": "2026-04-15"
+      }
+    ],
+    "last_updated": "2026-05-25",
+    "discovery_attribution_note": "Imported from NVD (CWE-77/CWE-78; NIST CVSS 8.6) + the 2026 MCP supply-chain advisory family (OX Security). Member of the MCP command-injection class already curated in depth by CVE-2026-22252 and CVE-2026-22688.",
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Agent Zero executes MCP server configurations without validating the command, letting an attacker who controls a configuration run arbitrary commands on the host."
+  },
+  "CVE-2026-30616": {
+    "name": "Jaaz MCP stdio Command Execution RCE",
+    "type": "RCE",
+    "cvss_score": 7.3,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+    "cvss_note": "CISA-ADP CVSS v3.1 base 7.3 (HIGH). Remote code execution in MCP stdio command execution handling.",
+    "cisa_kev": false,
+    "poc_available": true,
+    "poc_description": "Documented in the 2026 MCP supply-chain advisory family (OX Security) and the NVD record: an attacker who controls the MCP stdio configuration causes the host to execute attacker-influenced commands.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Disclosed via the coordinated 2026 MCP supply-chain advisory; the abused surface is the project's MCP command/transport configuration.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No AI-assisted weaponization; conventional command/argument injection through MCP configuration.",
+    "active_exploitation": "none",
+    "active_exploitation_notes": "Research / advisory disclosure; no confirmed in-the-wild exploitation reported as of curation.",
+    "affected": "Jaaz (AI design / agent application) version 1.0.30.",
+    "affected_versions": [
+      "Jaaz 1.0.30"
+    ],
+    "vector": "Jaaz mishandles MCP stdio command execution, running command/args from an MCP configuration without neutralizing special elements (CWE-77). An attacker able to set the stdio command achieves code execution on the Jaaz host.",
+    "complexity": "low",
+    "complexity_notes": "NVD AV:N / AC:L: network-reachable, low-complexity command injection through MCP configuration.",
+    "patch_available": false,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No confirmed fixed release at curation; mitigate by restricting who can configure MCP commands and running the service least-privilege.",
+    "vendor_update_paths": [
+      "Track the Jaaz project for a fixed release; until then restrict who can configure MCP stdio servers and run Jaaz as a least-privilege user."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "Flaw-remediation cadence does not track self-hosted AI agent / RAG frameworks and their MCP command surfaces as managed, RCE-bearing software.",
+      "ISO-27001-2022-A.8.8": "Vulnerability management rarely enumerates an AI framework's MCP command/transport configuration as an in-scope command-execution surface.",
+      "NIS2-Art21-patch-management": "Article 21 measures do not reach MCP command configuration as a privileged execution control plane.",
+      "DORA-Art-9": "ICT protection measures do not model command injection via an AI framework's MCP configuration.",
+      "UK-CAF-B4": "System Security objective has no objective for neutralizing command input handed to an AI framework's MCP transport.",
+      "AU-ISM-1546": "Patch-application control does not single out AI-framework MCP command surfaces.",
+      "ALL-AI-PIPELINE-INTEGRITY": "No framework treats user-supplied MCP command/args as untrusted input requiring neutralization; the transport's by-design command execution turns injection into direct RCE."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 35,
+    "rwep_factors": {
+      "cisa_kev": 0,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 0,
+      "blast_radius": 15,
+      "patch_available": 0,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "Standard (RWEP 35, \"patch within 30 days\" band per lib/scoring.js timeline). Not KEV, no confirmed in-the-wild exploitation. poc_available=20 (documented technique) + blast_radius=15.",
+    "epss_score": null,
+    "epss_date": "2026-05-25",
+    "epss_note": "EPSS not pulled for this entry; retrieve via FIRST EPSS API in a future refresh.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-30616",
+    "cwe_refs": [
+      "CWE-77",
+      "CWE-78"
+    ],
+    "iocs": {
+      "behavioral": [
+        "jaaz spawning a subprocess whose command/args came from an MCP configuration supplied or influenced by a caller rather than a pinned configuration.",
+        "Shell metacharacters, or allow-listed binaries (npm/npx) carrying execution flags, in MCP command/args values.",
+        "An MCP configuration / management surface reachable by a user who should not control command execution.",
+        "Jaaz 1.0.30 - the exposed precondition."
+      ],
+      "_ioc_source_note": "Behavioral signatures derived from NVD CVE-2026-30616 (CWE-77/CWE-78 command injection via MCP configuration) and the 2026 MCP supply-chain advisory (https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/) describing the unvalidated-MCP-command class."
+    },
+    "source_verified": "2026-05-25",
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-30616",
+      "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "NVD",
+        "advisory_id": "CVE-2026-30616",
+        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30616",
+        "severity": "high",
+        "published_date": "2026-04-15"
+      }
+    ],
+    "last_updated": "2026-05-25",
+    "discovery_attribution_note": "Imported from NVD (CWE-77/CWE-78; NIST CVSS 7.3) + the 2026 MCP supply-chain advisory family (OX Security). Member of the MCP command-injection class already curated in depth by CVE-2026-22252 and CVE-2026-22688.",
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Jaaz mishandles MCP stdio command execution, letting an attacker who sets the stdio command run arbitrary commands on the host."
+  },
+  "CVE-2026-30617": {
+    "name": "Langchain-Chatchat MCP Management Interface stdio RCE",
+    "type": "RCE",
+    "cvss_score": 8.6,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
+    "cvss_note": "NVD CVSS v3.1 base 8.6 (HIGH). RCE through an exposed MCP management interface that configures malicious stdio server commands.",
+    "cisa_kev": false,
+    "poc_available": true,
+    "poc_description": "Documented in the 2026 MCP supply-chain advisory family (OX Security) and the NVD record: an attacker who controls the MCP stdio configuration causes the host to execute attacker-influenced commands.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Disclosed via the coordinated 2026 MCP supply-chain advisory; the abused surface is the project's MCP command/transport configuration.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No AI-assisted weaponization; conventional command/argument injection through MCP configuration.",
+    "active_exploitation": "none",
+    "active_exploitation_notes": "Research / advisory disclosure; no confirmed in-the-wild exploitation reported as of curation.",
+    "affected": "Langchain-Chatchat (RAG / knowledge-base assistant) version 0.3.1.",
+    "affected_versions": [
+      "Langchain-Chatchat 0.3.1"
+    ],
+    "vector": "Langchain-Chatchat exposes an MCP management interface that lets a caller configure a malicious stdio server command, which the server then executes without neutralizing special elements (CWE-77), yielding remote code execution on the host.",
+    "complexity": "low",
+    "complexity_notes": "NVD AV:N / AC:L: network-reachable, low-complexity command injection through MCP configuration.",
+    "patch_available": false,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No confirmed fixed release at curation; mitigate by restricting who can configure MCP commands and running the service least-privilege.",
+    "vendor_update_paths": [
+      "Track the Langchain-Chatchat project for a fixed release; until then do not expose the MCP management interface to untrusted networks and run the service as a least-privilege user."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "Flaw-remediation cadence does not track self-hosted AI agent / RAG frameworks and their MCP command surfaces as managed, RCE-bearing software.",
+      "ISO-27001-2022-A.8.8": "Vulnerability management rarely enumerates an AI framework's MCP command/transport configuration as an in-scope command-execution surface.",
+      "NIS2-Art21-patch-management": "Article 21 measures do not reach MCP command configuration as a privileged execution control plane.",
+      "DORA-Art-9": "ICT protection measures do not model command injection via an AI framework's MCP configuration.",
+      "UK-CAF-B4": "System Security objective has no objective for neutralizing command input handed to an AI framework's MCP transport.",
+      "AU-ISM-1546": "Patch-application control does not single out AI-framework MCP command surfaces.",
+      "ALL-AI-PIPELINE-INTEGRITY": "No framework treats user-supplied MCP command/args as untrusted input requiring neutralization; the transport's by-design command execution turns injection into direct RCE."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 42,
+    "rwep_factors": {
+      "cisa_kev": 0,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 0,
+      "blast_radius": 22,
+      "patch_available": 0,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "Elevated (RWEP 42, \"patch within 7 days\" band per lib/scoring.js timeline). Not KEV, no confirmed in-the-wild exploitation. poc_available=20 (documented technique) + blast_radius=22.",
+    "epss_score": null,
+    "epss_date": "2026-05-25",
+    "epss_note": "EPSS not pulled for this entry; retrieve via FIRST EPSS API in a future refresh.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-30617",
+    "cwe_refs": [
+      "CWE-77",
+      "CWE-78"
+    ],
+    "iocs": {
+      "behavioral": [
+        "Langchain-Chatchat spawning a subprocess whose command/args came from an MCP configuration supplied or influenced by a caller rather than a pinned configuration.",
+        "Shell metacharacters, or allow-listed binaries (npm/npx) carrying execution flags, in MCP command/args values.",
+        "An MCP configuration / management surface reachable by a user who should not control command execution.",
+        "Langchain-Chatchat 0.3.1 - the exposed precondition."
+      ],
+      "_ioc_source_note": "Behavioral signatures derived from NVD CVE-2026-30617 (CWE-77/CWE-78 command injection via MCP configuration) and the 2026 MCP supply-chain advisory (https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/) describing the unvalidated-MCP-command class."
+    },
+    "source_verified": "2026-05-25",
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-30617",
+      "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "NVD",
+        "advisory_id": "CVE-2026-30617",
+        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30617",
+        "severity": "high",
+        "published_date": "2026-04-15"
+      }
+    ],
+    "last_updated": "2026-05-25",
+    "discovery_attribution_note": "Imported from NVD (CWE-77/CWE-78; NIST CVSS 8.6) + the 2026 MCP supply-chain advisory family (OX Security). Member of the MCP command-injection class already curated in depth by CVE-2026-22252 and CVE-2026-22688.",
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Langchain-Chatchat exposes an MCP management interface that lets a caller configure a malicious stdio command the server then executes, yielding RCE."
+  },
+  "CVE-2026-30625": {
+    "name": "Upsonic MCP Task Allowed-Command Argument Injection RCE",
+    "type": "RCE",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cvss_note": "NVD CVSS v3.1 base 9.8 (CRITICAL). RCE via MCP task creation where allow-listed commands (npm, npx) accept flags that enable arbitrary OS command execution.",
+    "cisa_kev": false,
+    "poc_available": true,
+    "poc_description": "Documented in the 2026 MCP supply-chain advisory family (OX Security) and the NVD record: an attacker who controls the MCP task command allow-list arguments causes the host to execute attacker-influenced commands.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Disclosed via the coordinated 2026 MCP supply-chain advisory; the abused surface is the project's MCP command/transport configuration.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No AI-assisted weaponization; conventional command/argument injection through MCP configuration.",
+    "active_exploitation": "none",
+    "active_exploitation_notes": "Research / advisory disclosure; no confirmed in-the-wild exploitation reported as of curation.",
+    "affected": "Upsonic (agent framework) version 0.71.6; a warning was added in 0.72.0 but a full fix is not confirmed.",
+    "affected_versions": [
+      "Upsonic 0.71.6"
+    ],
+    "vector": "Upsonic MCP task creation allows certain commands (npm, npx) whose argument flags can be abused to execute arbitrary OS commands (CWE-77 argument injection). An attacker who can create an MCP task achieves code execution on the host. Version 0.72.0 adds a warning rather than a confirmed fix.",
+    "complexity": "low",
+    "complexity_notes": "NVD AV:N / AC:L: network-reachable, low-complexity command injection through MCP configuration.",
+    "patch_available": false,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No confirmed fixed release at curation; mitigate by restricting who can configure MCP commands and running the service least-privilege.",
+    "vendor_update_paths": [
+      "Upgrade to Upsonic 0.72.0+ for the added warning, but treat the allow-list as insufficient: restrict who can create MCP tasks and run Upsonic as a least-privilege user until a confirmed fix ships."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "Flaw-remediation cadence does not track self-hosted AI agent / RAG frameworks and their MCP command surfaces as managed, RCE-bearing software.",
+      "ISO-27001-2022-A.8.8": "Vulnerability management rarely enumerates an AI framework's MCP command/transport configuration as an in-scope command-execution surface.",
+      "NIS2-Art21-patch-management": "Article 21 measures do not reach MCP command configuration as a privileged execution control plane.",
+      "DORA-Art-9": "ICT protection measures do not model command injection via an AI framework's MCP configuration.",
+      "UK-CAF-B4": "System Security objective has no objective for neutralizing command input handed to an AI framework's MCP transport.",
+      "AU-ISM-1546": "Patch-application control does not single out AI-framework MCP command surfaces.",
+      "ALL-AI-PIPELINE-INTEGRITY": "No framework treats user-supplied MCP command/args as untrusted input requiring neutralization; the transport's by-design command execution turns injection into direct RCE."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 38,
+    "rwep_factors": {
+      "cisa_kev": 0,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 0,
+      "blast_radius": 18,
+      "patch_available": 0,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "Standard (RWEP 38, \"patch within 30 days\" band per lib/scoring.js timeline). Not KEV, no confirmed in-the-wild exploitation. poc_available=20 (documented technique) + blast_radius=18.",
+    "epss_score": null,
+    "epss_date": "2026-05-25",
+    "epss_note": "EPSS not pulled for this entry; retrieve via FIRST EPSS API in a future refresh.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-30625",
+    "cwe_refs": [
+      "CWE-77",
+      "CWE-78"
+    ],
+    "iocs": {
+      "behavioral": [
+        "Upsonic spawning a subprocess whose command/args came from an MCP configuration supplied or influenced by a caller rather than a pinned configuration.",
+        "Shell metacharacters, or allow-listed binaries (npm/npx) carrying execution flags, in MCP command/args values.",
+        "An MCP configuration / management surface reachable by a user who should not control command execution.",
+        "Upsonic 0.71.6 - the exposed precondition."
+      ],
+      "_ioc_source_note": "Behavioral signatures derived from NVD CVE-2026-30625 (CWE-77/CWE-78 command injection via MCP configuration) and the 2026 MCP supply-chain advisory (https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/) describing the unvalidated-MCP-command class."
+    },
+    "source_verified": "2026-05-25",
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-30625",
+      "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "NVD",
+        "advisory_id": "CVE-2026-30625",
+        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30625",
+        "severity": "critical",
+        "published_date": "2026-04-15"
+      }
+    ],
+    "last_updated": "2026-05-25",
+    "discovery_attribution_note": "Imported from NVD (CWE-77/CWE-78; NIST CVSS 9.8) + the 2026 MCP supply-chain advisory family (OX Security). Member of the MCP command-injection class already curated in depth by CVE-2026-22252 and CVE-2026-22688.",
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Upsonic allow-lists npm/npx for MCP tasks, but their argument flags enable arbitrary OS command execution, so an attacker who can create a task achieves RCE."
+  },
+  "CVE-2026-26015": {
+    "name": "DocsGPT MCP stdio Unauthenticated Remote Code Execution",
+    "type": "RCE",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cvss_note": "NVD CVSS v3.1 base 9.8 (CRITICAL); the GitHub advisory scores 10.0. Unauthenticated: a crafted payload bypasses the MCP test behavior to execute commands.",
+    "cisa_kev": false,
+    "poc_available": true,
+    "poc_description": "Documented in the GitHub Security Advisory GHSA-gcrq-f296-2j74 and the 2026 MCP supply-chain advisory: a crafted MCP stdio configuration payload bypasses DocsGPT's MCP test/validation behavior and runs shell commands without authentication, on both hosted and self-hosted instances.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Disclosed via coordinated advisory; DocsGPT is an open-source documentation RAG assistant and the abused surface is its MCP stdio configuration.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No AI-assisted weaponization; command injection through the MCP stdio configuration, reachable without authentication.",
+    "active_exploitation": "none",
+    "active_exploitation_notes": "Research / advisory disclosure with a coordinated fix; no confirmed in-the-wild exploitation reported as of curation.",
+    "affected": "DocsGPT (arc53) versions 0.15.0 up to (but not including) 0.16.0.",
+    "affected_versions": [
+      "DocsGPT >= 0.15.0, < 0.16.0"
+    ],
+    "vector": "DocsGPT accepts an MCP server configuration with a stdio transport whose shell command it executes. A crafted payload bypasses the MCP test/validation step, so the command runs without authorization or neutralization (CWE-77), giving an unauthenticated attacker remote code execution on the DocsGPT host.",
+    "complexity": "low",
+    "complexity_notes": "NVD AV:N / AC:L / PR:N — network-reachable, low-complexity, unauthenticated command injection.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "Remediation is an application upgrade to DocsGPT 0.16.0 or later; redeploy, no host reboot.",
+    "vendor_update_paths": [
+      "Upgrade DocsGPT (arc53) to 0.16.0 or later. Until then, do not expose DocsGPT to untrusted networks, restrict MCP configuration, and run it as a least-privilege container user."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "Flaw-remediation cadence does not track self-hosted documentation/RAG assistants and their MCP transports as managed, RCE-bearing software.",
+      "ISO-27001-2022-A.8.8": "Vulnerability management rarely enumerates an AI assistant's MCP stdio configuration as an unauthenticated command-execution surface.",
+      "NIS2-Art21-patch-management": "Article 21 measures do not reach the MCP stdio configuration as a privileged, unauthenticated execution control plane.",
+      "DORA-Art-9": "ICT protection measures do not model unauthenticated command injection via an AI assistant's MCP configuration.",
+      "UK-CAF-B4": "System Security objective has no objective for authenticating and neutralizing command input handed to an AI assistant's MCP transport.",
+      "AU-ISM-1546": "Patch-application control does not single out AI-assistant MCP transports.",
+      "ALL-AI-PIPELINE-INTEGRITY": "No framework requires the MCP transport to authenticate callers and neutralize the stdio command; a bypassable validation step is not an authorization boundary."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 27,
+    "rwep_factors": {
+      "cisa_kev": 0,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 0,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "Standard (RWEP 27, \"patch within 30 days\" band per lib/scoring.js timeline). Not KEV, no confirmed in-the-wild exploitation, patched at disclosure (Hard Rule #3). poc_available=20 + blast_radius=22 minus patch 15. Note: unauthenticated reachability raises operational urgency beyond the RWEP number.",
+    "epss_score": null,
+    "epss_date": "2026-05-25",
+    "epss_note": "EPSS not pulled for this entry; retrieve via FIRST EPSS API in a future refresh.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-26015",
+    "cwe_refs": [
+      "CWE-77",
+      "CWE-78"
+    ],
+    "iocs": {
+      "behavioral": [
+        "DocsGPT spawning a subprocess whose command came from an MCP stdio configuration rather than a pinned configuration.",
+        "MCP configuration requests to a DocsGPT instance from unauthenticated or untrusted sources.",
+        "Shell metacharacters or unexpected binaries in DocsGPT MCP stdio command values.",
+        "DocsGPT version >= 0.15.0 and < 0.16.0 — the exposed precondition."
+      ],
+      "_ioc_source_note": "Behavioral signatures derived from GitHub Security Advisory GHSA-gcrq-f296-2j74 / NVD CVE-2026-26015 (CWE-77 unauthenticated command injection via MCP stdio configuration) and the 2026 MCP supply-chain advisory (https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/)."
+    },
+    "source_verified": "2026-05-25",
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-26015",
+      "https://github.com/arc53/DocsGPT/security/advisories/GHSA-gcrq-f296-2j74",
+      "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "GitHub Security Advisory",
+        "advisory_id": "CVE-2026-26015",
+        "url": "https://github.com/arc53/DocsGPT/security/advisories/GHSA-gcrq-f296-2j74",
+        "severity": "critical",
+        "published_date": "2026-04-29"
+      },
+      {
+        "vendor": "NVD",
+        "advisory_id": "CVE-2026-26015",
+        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26015",
+        "severity": "critical",
+        "published_date": "2026-04-29"
+      }
+    ],
+    "last_updated": "2026-05-25",
+    "discovery_attribution_note": "Manually curated from NVD (CWE-77/CWE-78; NIST CVSS 9.8) + GHSA GHSA-gcrq-f296-2j74 + the 2026 MCP supply-chain advisory family. Unauthenticated member of the MCP command-injection class curated in depth by CVE-2026-22252 and CVE-2026-22688.",
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "DocsGPT executes an MCP stdio configuration's shell command after a bypassable validation step, giving an unauthenticated attacker remote code execution; fixed in 0.16.0."
+  },
+  "CVE-2026-9082": {
+    "name": "Drupal Core Database API Unauthenticated SQL Injection (SA-CORE-2026-004)",
+    "type": "SQLI",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cvss_note": "NVD CVSS v3.1 base 9.8 (CRITICAL); Drupal rates SA-CORE-2026-004 Highly Critical. Unauthenticated SQL injection via the database abstraction layer on PostgreSQL-backed sites.",
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-05-22",
+    "cisa_kev_due_date": "2026-05-27",
+    "poc_available": true,
+    "poc_description": "Public proof-of-concept and scanners exist for the unauthenticated SQL injection in Drupal's PostgreSQL EntityQuery condition handler reachable via JSON:API (e.g. github.com/ridhinva/CVE-2026-9082). Drupal published SA-CORE-2026-004 with fixes across all supported branches.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Conventional SQL injection in Drupal core's database abstraction layer; no AI-discovery attribution. Reported through Drupal's security advisory process (SA-CORE-2026-004).",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No AI-assisted weaponization reported; classic unauthenticated SQL injection.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "CISA added CVE-2026-9082 to the KEV catalog (catalog version 2026.05.22) on 2026-05-22 with a 2026-05-27 remediation due date, indicating confirmed active exploitation in the wild. Public reporting describes exploitation of PostgreSQL-backed Drupal sites within days of disclosure.",
+    "affected": "Drupal core 8.9.0 to <10.4.10, 10.5.0 to <10.5.10, 10.6.0 to <10.6.9, 11.0.0 to <11.1.10, 11.2.0 to <11.2.12, and 11.3.0 to <11.3.10; the SQL injection is reachable on PostgreSQL-backed sites via JSON:API.",
+    "affected_versions": [
+      "Drupal core >= 8.9.0, < 10.4.10",
+      "Drupal core >= 10.5.0, < 10.5.10",
+      "Drupal core >= 10.6.0, < 10.6.9",
+      "Drupal core >= 11.0.0, < 11.1.10",
+      "Drupal core >= 11.2.0, < 11.2.12",
+      "Drupal core >= 11.3.0, < 11.3.10"
+    ],
+    "vector": "Drupal core's database abstraction layer fails to neutralize special elements in a query condition handler used by the PostgreSQL driver and reachable through JSON:API, allowing an unauthenticated attacker to inject SQL (CWE-89). Exploitation can lead to information disclosure, data modification, and in some configurations privilege escalation toward code execution.",
+    "complexity": "low",
+    "complexity_notes": "NVD AV:N / AC:L / PR:N — network-reachable, low-complexity, unauthenticated SQL injection.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "Remediation is a Drupal core upgrade to 10.4.10 / 10.5.10 / 10.6.9 / 11.1.10 / 11.2.12 / 11.3.10 per SA-CORE-2026-004; clear caches, no host reboot.",
+    "vendor_update_paths": [
+      "Upgrade Drupal core to 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10 (the fixed release on your branch) per SA-CORE-2026-004. PostgreSQL-backed sites are the exploited configuration; prioritize them. Meet the CISA KEV due date of 2026-05-27."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "Flaw-remediation cadence frequently misses CMS-core SQL injection in the window between KEV listing (2026-05-22) and the 2026-05-27 due date.",
+      "NIST-800-53-SI-10": "Input-validation control is asserted at the application layer but not verified at the database abstraction layer where the query condition handler builds SQL.",
+      "ISO-27001-2022-A.8.8": "Vulnerability management rarely treats the CMS database driver's query builder as an unauthenticated injection surface.",
+      "NIS2-Art21-patch-management": "Article 21 measures do not enforce the sub-week remediation cadence an actively-exploited unauthenticated CMS SQLi demands.",
+      "DORA-Art-9": "ICT protection measures do not model an unauthenticated SQL injection in a third-party CMS core as an ICT-risk event with a regulator clock.",
+      "UK-CAF-B4": "System Security objective has no objective for verifying parameterization in the CMS database abstraction layer.",
+      "AU-ISM-1546": "Patch-application control does not single out actively-exploited CMS-core injection for accelerated remediation."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190"
+    ],
+    "rwep_score": 78,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 28,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 (RWEP 78, >= 75 \"patch or compensating controls within 24 hours\" band per lib/scoring.js timeline). CISA KEV 25 + poc 20 + active_exploitation confirmed 20 + blast_radius 28 (Drupal core install base) minus patch 15. Meet the CISA due date 2026-05-27.",
+    "epss_score": null,
+    "epss_date": "2026-05-25",
+    "epss_note": "EPSS not pulled for this entry; retrieve via FIRST EPSS API in a future refresh.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-9082",
+    "cwe_refs": [
+      "CWE-89"
+    ],
+    "iocs": {
+      "behavioral": [
+        "Anomalous JSON:API requests to a PostgreSQL-backed Drupal site carrying SQL metacharacters in filter/condition parameters.",
+        "Unexpected database errors or query-shape changes originating from the EntityQuery condition handler.",
+        "Drupal core version below the SA-CORE-2026-004 fixed release on its branch (e.g. < 10.4.10 / < 10.5.10 / < 10.6.9 / < 11.1.10 / < 11.2.12 / < 11.3.10) on PostgreSQL — the exposed precondition.",
+        "Outbound data egress or new admin accounts following anomalous JSON:API traffic."
+      ],
+      "_ioc_source_note": "Behavioral signatures derived from Drupal SA-CORE-2026-004 (https://www.drupal.org/sa-core-2026-004), NVD CVE-2026-9082 (CWE-89 SQL injection via the PostgreSQL EntityQuery condition handler reachable through JSON:API), and the CISA KEV listing (catalog version 2026.05.22)."
+    },
+    "source_verified": "2026-05-25",
+    "verification_sources": [
+      "https://www.drupal.org/sa-core-2026-004",
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-9082"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "Drupal Security Team",
+        "advisory_id": "SA-CORE-2026-004",
+        "url": "https://www.drupal.org/sa-core-2026-004",
+        "severity": "critical",
+        "published_date": "2026-05-20"
+      },
+      {
+        "vendor": "NVD",
+        "advisory_id": "CVE-2026-9082",
+        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9082",
+        "severity": "critical",
+        "published_date": "2026-05-20"
+      }
+    ],
+    "last_updated": "2026-05-25",
+    "discovery_attribution_note": "Manually curated from NVD (CWE-89; NIST CVSS 9.8) + Drupal SA-CORE-2026-004 + the CISA KEV listing (catalog version 2026.05.22, added 2026-05-22, due 2026-05-27). Conventional unauthenticated SQL injection, no AI-discovery attribution.",
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Drupal core's database abstraction layer fails to neutralize special elements in a PostgreSQL query condition handler reachable via JSON:API, allowing unauthenticated SQL injection; actively exploited (CISA KEV 2026-05-22, due 2026-05-27); fixed in SA-CORE-2026-004 releases."
+  },
   "CVE-2026-41091": {
     "name": "Microsoft Defender (Malware Protection Engine) Link-Following LPE to SYSTEM",
     "type": "LPE",