VulnCheck Source-Review CVEs Hit Agent Tooling: mini-swe-agent's Bubblewrap Sandbox Inherits Host API Keys (CVE-2026-108592), 9router Writes Shell Hooks Into Hermes Agent's config.yaml (CVE-2026-108593), and mcp-remote's Device-Code Flow Sends Secrets Over HTTP (CVE-2026-108716)

VulnCheck, as CNA, published dozens of CVEs from 10 October 2026 onward for findings from a static source review of MCP servers, agent frameworks and LLM gateways, mostly with no fixed version named; the Unla and mac-shell-mcp records from the same batch are in an earlier entry. Three affect tools that run on developer machines. CVE-2026-108592 (CVSS 4.0 6.0, 10 October): mini-swe-agent 1.10.0 to 2.4.6 starts its optional BubblewrapEnvironment sandbox without --clearenv, so sandboxed commands inherit the host environment, and prompt injection in task content can make the agent read API keys from it and send them out over the shared network; 2.4.6 is still the latest release on PyPI. CVE-2026-108593 (CVSS 4.0 7.3, 10 October): the 9router dashboard's POST /api/cli-tools/hermes-settings endpoint, in 0.4.1 to 0.5.99, writes a submitted baseUrl into Hermes Agent's config.yaml without encoding, so an authenticated dashboard user can add hooks_auto_accept and a hooks.post_llm_call shell command that Hermes runs without approval after its next LLM call. CVE-2026-108716 (CVSS 4.0 6.0, 11 October): mcp-remote 0.8.0 to 0.14.3, with --device-code, sends the client secret and receives access and refresh tokens without requiring HTTPS, so when discovery returns non-loopback http:// device-authorization and token endpoints, anyone on the network path can read all three. The researchers reviewed source only, and the write-ups record no maintainer response.

You are affected if you run mini-swe-agent >=1.10.0 <=2.4.6.

For mini-swe-agent, keep API keys out of the environment the agent runs in (or wrap bwrap with --clearenv and --unshare-net and pass in only what a task needs), and rotate keys that were present while it processed untrusted tasks. For 9router, keep dashboard login on, restrict who can reach the dashboard, check ~/.hermes/config.yaml for hooks or hooks_auto_accept entries you did not write, and confirm that a release later than 0.5.99 actually encodes the value before relying on an upgrade. For mcp-remote, do not use --device-code against a server whose discovery metadata returns plain-HTTP endpoints, and revoke tokens issued through such a flow.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run mini-swe-agent and which version, then enforce a policy on it.