{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-108592",
    "name": "CVE-2026-108592",
    "vendor": "mini-swe-agent",
    "description": "VulnCheck, as CNA, published dozens of CVEs from 10 October 2026 onward for findings from a static source review of MCP servers, agent frameworks and LLM gateways, mostly with no fixed version named; the Unla and mac-shell-mcp records from the same batch are in an earlier entry. Three affect tools that run on developer machines. CVE-2026-108592 (CVSS 4.0 6.0, 10 October): mini-swe-agent 1.10.0 to 2.4.6 starts its optional BubblewrapEnvironment sandbox without --clearenv, so sandboxed commands inherit the host environment, and prompt injection in task content can make the agent read API keys from it and send them out over the shared network; 2.4.6 is still the latest release on PyPI. CVE-2026-108593 (CVSS 4.0 7.3, 10 October): the 9router dashboard's POST /api/cli-tools/hermes-settings endpoint, in 0.4.1 to 0.5.99, writes a submitted baseUrl into Hermes Agent's config.yaml without encoding, so an authenticated dashboard user can add hooks_auto_accept and a hooks.post_llm_call shell command that Hermes runs without approval after its next LLM call. CVE-2026-108716 (CVSS 4.0 6.0, 11 October): mcp-remote 0.8.0 to 0.14.3, with --device-code, sends the client secret and receives access and refresh tokens without requiring HTTPS, so when discovery returns non-loopback http:// device-authorization and token endpoints, anyone on the network path can read all three. The researchers reviewed source only, and the write-ups record no maintainer response.",
    "website": "https://www.vulncheck.com/advisories/9router-0.4.1-through-0.5.99-config-injection-rce-via-hermes-settings-endpoint",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "unknown",
      "packageName": "mini-swe-agent",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-10-10",
    "risk": {
      "score": 60,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-108592",
      "aliases": [
        "ti-167"
      ],
      "title": "VulnCheck Source-Review CVEs Hit Agent Tooling: mini-swe-agent's Bubblewrap Sandbox Inherits Host API Keys (CVE-2026-108592), 9router Writes Shell Hooks Into Hermes Agent's config.yaml (CVE-2026-108593), and mcp-remote's Device-Code Flow Sends Secrets Over HTTP (CVE-2026-108716)",
      "summary": "VulnCheck, as CNA, published dozens of CVEs from 10 October 2026 onward for findings from a static source review of MCP servers, agent frameworks and LLM gateways, mostly with no fixed version named; the Unla and mac-shell-mcp records from the same batch are in an earlier entry. Three affect tools that run on developer machines. CVE-2026-108592 (CVSS 4.0 6.0, 10 October): mini-swe-agent 1.10.0 to 2.4.6 starts its optional BubblewrapEnvironment sandbox without --clearenv, so sandboxed commands inherit the host environment, and prompt injection in task content can make the agent read API keys from it and send them out over the shared network; 2.4.6 is still the latest release on PyPI. CVE-2026-108593 (CVSS 4.0 7.3, 10 October): the 9router dashboard's POST /api/cli-tools/hermes-settings endpoint, in 0.4.1 to 0.5.99, writes a submitted baseUrl into Hermes Agent's config.yaml without encoding, so an authenticated dashboard user can add hooks_auto_accept and a hooks.post_llm_call shell command that Hermes runs without approval after its next LLM call. CVE-2026-108716 (CVSS 4.0 6.0, 11 October): mcp-remote 0.8.0 to 0.14.3, with --device-code, sends the client secret and receives access and refresh tokens without requiring HTTPS, so when discovery returns non-loopback http:// device-authorization and token endpoints, anyone on the network path can read all three. The researchers reviewed source only, and the write-ups record no maintainer response.",
      "severity": "high",
      "cvss": {
        "score": 6,
        "vector": null,
        "version": "4.0"
      },
      "cwe": [],
      "attackType": [
        "Prompt injection"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "mini-swe-agent",
        "vendor": null,
        "package": "mini-swe-agent",
        "ecosystem": null,
        "catalogSlug": "agent/mini-swe-agent"
      },
      "affected": [
        {
          "range": ">=1.10.0 <=2.4.6",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-10",
      "modifiedAt": "2026-10-10",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://www.vulncheck.com/advisories/9router-0.4.1-through-0.5.99-config-injection-rce-via-hermes-settings-endpoint"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108592"
        }
      ],
      "mitigation": "For mini-swe-agent, keep API keys out of the environment the agent runs in (or wrap bwrap with --clearenv and --unshare-net and pass in only what a task needs), and rotate keys that were present while it processed untrusted tasks. For 9router, keep dashboard login on, restrict who can reach the dashboard, check ~/.hermes/config.yaml for hooks or hooks_auto_accept entries you did not write, and confirm that a release later than 0.5.99 actually encodes the value before relying on an upgrade. For mcp-remote, do not use --device-code against a server whose discovery metadata returns plain-HTTP endpoints, and revoke tokens issued through such a flow.",
      "detectedByAnomity": true
    }
  }
}