Three days of advisories since Monday, and the same defect keeps showing up under different names: a security control that exists, is documented, and does not hold. MLflow's pickle guard is missing from one model flavor. NLTK shipped its path-security module defaulting to warn-only. omnigent's shell guardrail fails open on syntax it does not recognise. Separately, unstructured has a 9.3 unauthenticated SSRF, and orval collected twelve criticals in forty-eight hours. If you build RAG ingestion, patch unstructured first.

Worth your morning

unstructured — a 9.3 in the library that reads your documents. CVE-2026-71428 is unauthenticated server-side request forgery in the URL-based partitioning functions, AV:N/AC:L/PR:N/UI:N/S:C, affecting everything from 0.4.7 to 0.23.x and fixed in 0.24.0. The scope change in the vector is the part that matters: responses come back, so this reads internal HTTP services and cloud metadata endpoints rather than merely reaching them.

The deployment shape is what makes it worth leading with. unstructured sits at the ingestion end of most Python RAG pipelines, and the affected functions are the ones that take a URL because a user handed you a URL. If you accept a link and partition it, the fetch runs with your network position. 0.24.0 is the floor; 0.27.5 is current. Take current, and if the ingestion endpoint is reachable by anyone outside your team, treat the metadata service as having been in reach and rotate what it hands out.

NLTK — the security module was in warn-only mode the whole time. Eleven advisories landed on the 1st and 2nd. The critical is CVE-2026-79675 (9.3), JVM argument injection through the java_options parameter in the Stanford wrapper classes, fixed in 3.10.3 — the version this digest has been naming since August.

The one to actually read is CVE-2026-62388 (8.7), because it changes what "patched" means for the other ten. NLTK's pathsec module — the thing that enforces file-access, URL and deserialization safety, added specifically to remediate CVE-2024-39705 and CVE-2026-0846 — defaults to ENFORCE=False. All eight validation functions emit a runtime warning and then proceed. Anyone who upgraded for those two earlier CVEs got the checks installed and not switched on.

The fix is opt-in: set NLTK_PATHSEC_ENFORCE=1 in the deployment environment. Upgrading without setting it leaves you exactly where you were, with a warning in the logs you were never reading. And note the residual — CVE-2026-81726 (8.3) says the model-artifact APIs step around pathsec even when enforcement is on, affects 3.10.3 and below, and names no fixed version. That one is open on current.

MLflow — the guard is on every flavor but one. GHSA-gqvg-gmmx-x4hm (8.8, no CVE) affects 2.1.0 through 3.14.x and is fixed in 3.15.0. MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False is the documented control for refusing to unpickle untrusted model artifacts; the mlflow.statsmodels flavor omits the check entirely. An operator who set the flag, and who could reasonably describe their registry as hardened, is not protected on that one path.

This digest has carried "MLflow wants 3.15.0 or later" since July for a different advisory, so most readers are already above the floor. The reason to flag it anyway is the belief it corrects. If you set that environment variable and wrote it down as a mitigating control somewhere, the control had a hole in it for the entire 3.x line, and any statsmodels artifact that reached your registry from outside your team was never covered by it.

omnigent — the guardrail parser fails open. Four advisories, all fixed in 0.3.0. The critical is CVE-2026-62674 (9.0), shared agent bundles overwriting each other into runner code execution. The one that fits this week's pattern is CVE-2026-62676 (7.1): the shell-command policy parser does not recognise every form of shell syntax, and what it does not recognise, it permits. omnigent is a policy-and-sandbox harness for running coding agents — the allowlist is the entire product. Current is 0.12.0, nine minors past the fix.

pnpm — four highs in the tool that installs everything else. Two path-traversal issues let a crafted lockfile (CVE-2026-82392, 7.1) or a tarball dependency's manifest name (CVE-2026-82393, 7.5) write files outside node_modules during install — the second explicitly survives --ignore-scripts, which is the flag most teams treat as the answer to hostile packages. A third (GHSA-vx52-2968-3vc6, 7.4, no CVE) exfiltrates environment secrets such as NPM_TOKEN through unguarded placeholder expansion in proxy config. Fixed in 10.34.5 and 11.11.0; 11.25.0 is current.

Worth ten minutes on your build agents specifically. CI runners hold the registry tokens, install from lockfiles they did not write when building forks, and are the least likely part of the estate to have had its package manager bumped this quarter.

orval — twelve criticals, one floor. All of them are the same shape: values from an OpenAPI document reach generated TypeScript unescaped, so a hostile spec becomes code at generation or import time. CVE-2026-62681 (9.3) names 8.21.0, but the SSRF and file-inclusion advisory CVE-2026-62680 (7.1) names 8.22.0 — use that as the floor. Current is 8.28.1.

Exposure depends entirely on where your spec comes from. If it is checked into your own repo and reviewed like code, this is a routine bump. If your build fetches a partner's or a vendor's spec at generation time, that vendor has had code execution on your build machine, and the fix is the upgrade plus pinning the spec to a reviewed copy.

Standing items

Milvus, day twenty-four. CVE-2026-69111 (8.7) is unchanged. PR #49847 is still open, still one approval short of two, Code-Check still failing, no activity since August 14. Port 9091 stays firewalled.

Ollama remains clean. Still no published advisories, ever.

vLLM: 0.28.0 was already the answer. GHSA-25q3-v2hm-8vpf (7.5, no CVE) landed September 3 — a single unauthenticated request with a negative token ID on /v1/embeddings or /pooling takes the engine down hard enough that it does not come back on its own. Same fixed version as last week's five, so if you took 0.28.0 on Monday you are done.

Carried unchanged from September 1: Chainlit wants 2.12.0 or MCP off, PraisonAI wants 4.6.58 with an audit after it, pantheon-agents wants 0.6.4 plus credential rotation, RestrictedPython wants 8.3, the npm MariaDB connector wants 3.2.4 / 3.3.3 / 3.4.6 / 3.5.3, engine.io wants 6.6.7, 9router is fixed for two of eleven at 0.5.2, vm2 wants 3.11.6, xinference wants 2.7.0, jsonata wants 1.8.8 / 2.2.1 with Node-RED still pinned below the floor, MONAI wants 1.6.0, hydra-core wants 1.3.4, Flowise is archived at 3.1.4 with four permanent criticals, mcp-florence2 is vendor-declined, the unfixed MCP servers from August 17 are unchanged, AgenticSeek needs its token set plus a loopback bind, Langflow wants 1.11.3, Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, Open WebUI wants 0.11.0, n8n wants 1.123.69 / 2.33.4 / 2.34.1, SSH.NET wants the 2026.0.0 major, .NET wants 8.0.30 / 9.0.19 / 10.0.11.

Feed notes. NuGet has published nothing since a low-severity Magick.NET memory leak on September 2; the August 11 .NET batch is unchanged and the next Microsoft cycle is Tuesday. Nothing new from LangChain, LlamaIndex, Haystack, Triton, Qdrant, Chroma, Weaviate, Angular or PrimeNG.

Filtered out and why: sanitize-html ×2, qs ×2, fastify ×2, @tiptap/core, @xmldom/xmldom, @humanfs/node, toml and toml-node, liquidjs, stream-json, link-preview-js and phoenix — all moderate, or high but not touching a tracked component. scrapy (signed S3 requests over plaintext), mistune, tornado ×3, pypdf ×4, sqlparse, djangorestframework ×2 and mkdocs-material are real but not on either stack. Two @aborruso/ckan-mcp-server advisories are moderate and low against a single-maintainer MCP server with negligible install base. apostrophe, @apostrophecms/import-export, @platejs/docx-io, @dicebear/core, @appium/base-driver, orval's pre-2026 backlog, and the Go and Composer criticals — SiYuan ×3, SeaweedFS, OpenChoreo, Pimcore ×2, Yamcs — are outside scope entirely.