Vibe Coding
Tip: mcp-sequential-thinking's session import/export takes an arbitrary file_path (CVE-2026-81845)
CVE-2026-81845, published 2026-08-28 and scored 6.3 MEDIUM, covers arben-adm mcp-sequential-thinking through 0.5.0, where the `import_session` and `export_session` functions in mcp_sequential_thinking/server.py accept a `file_path` argument with no boundary validation, giving remote path traversal. The exploit is public. Worth an audit pass on any MCP server you run that persists or restores state to a caller-supplied path, since save/load is the most common place this parameter goes unvalidated.
Source
↳ Follow the thread