The official MCP Inspector, the tool most MCP developers use to try out a server, published nine advisories yesterday. Two are critical: on the 1.x line, connecting to a hostile server can run commands on your machine. Update to 1.0.3 or 2.12.0. Node.js shipped its October security release with four high-severity fixes, and the same release drops the compromised eMudhra root and carries the undici fixes this digest has tracked since last week. Storybook's critical dev-server flaw, fixed on October 12, reached GitHub's database yesterday.

A scanner that reads GitHub's database will flag Storybook's 9.4 and the older NLTK record. It won't flag any of the Inspector advisories, Storybook's 8.7, NLTK's 8.6 or CrewAI, and Node.js has no package record to flag.

Worth your morning

MCP Inspector: the 1.x line runs a hostile server's commands. The tool for checking what an MCP server does could be taken over by the server it was checking. The project published six advisories between 06:53 and 06:57 UTC yesterday and three more at 18:31.

• 1.x (0.13.0 to 1.0.2). In GHSA-6x67 and GHSA-4fc4 (9.6 each), connecting to a remote server and viewing its MCP App, or completing its OAuth callback, can run arbitrary commands on the developer's machine without any tool call. GHSA-wmjf (7.5) is a proxy function that requires no authentication. Three lower-rated records leak the proxy session token, forward Authorization and cookie headers across cross-origin redirects, and write auth headers to the proxy log.
• 2.x (2.0.0 to 2.11.0). In GHSA-q978 (8.8), a connected server can run code as the user on Windows and WSL during connection, with no prompt. GHSA-vcc9 (high) is an incomplete fix for last year's CVE-2025-49596: a web page the developer visits can read the Inspector's API token and the stored OAuth tokens for connected servers, in browsers without DNS-rebinding protection.
• A memory-exhaustion bug in the fetch proxy affects both lines.

1.0.3 reached npm at 06:20 UTC yesterday and 2.12.0 at 18:35. The latest tag is 2.12.0, and the legacy line's v1-latest is 1.0.3. Pin the version wherever a script or README launches the Inspector. None of the nine has a CVE or a GitHub database record. If you used an affected 2.x build with OAuth-connected servers, consider rotating those tokens.

Node.js: four highs, the eMudhra root and the undici fixes in one release. Node.js 22.23.4, 24.22.1 and 26.12.1 went out at 10:38 UTC yesterday, after this digest published. The release fixes ten CVEs. The four rated high are an out-of-bounds write in the Brotli decoder that the project says permits remote code execution, two ways a TLS hostname check could accept a certificate for the wrong host, and dns.resolve truncating names that contain a NUL byte. Two items this digest has carried close with it:

• Root store. All three lines move to NSS 3.131.1, and emSign ECC Root CA - G3 is gone from src/node_root_certs.h at each release tag. Node no longer trusts the root behind the compromised eMudhra intermediates.
• undici. The bundled copy is now 6.29.1, 7.30.1 and 8.12.2, the versions that fixed the eight undici flaws from October 15. Code that uses the built-in fetch or WebSocket gets those fixes only from this release.

The release also updates c-ares on all three lines, OpenSSL to 3.5.9 on 22.x and 24.x, and SQLite on 22.x. It covers 22.x, 24.x and 26.x only. Container images pinned to an exact Node patch version don't move on their own, so rebuild on the new tags.

Storybook: a critical in the dev server, fixed ten days ago. Storybook published two advisories on October 12, alongside 8.6.19, 9.1.21 and 10.6.2. This digest missed them because Storybook wasn't on its watch list. In GHSA-f2ph (9.4 on v4), a malicious website can interact with the preview of a running dev server; the developer only has to visit the page while storybook dev runs. In GHSA-px85 (8.7 on v4), a device on the same network can do the same. Storybook rates the result as code injection and has seen no exploitation. Built Storybooks, and dev servers that are never opened in a browser, aren't affected.

The fixed versions change defaults. The dev server listens on 127.0.0.1 only, the preview can't be embedded by a page on another host name, and preview and manager accept postMessage events only from their own origin and other localhost services. The flags security.insecureRemoteIframeEmbed and security.insecureIframeMessaging restore the old behaviour; leave them off unless a workflow breaks. Framework packages such as @storybook/angular version in step with storybook, so upgrade every @storybook/* package together. That includes @storybook/addon-mcp 10.6.0 – 10.6.1. Storybook also asks for Vite 6.4.2 / 7.3.2 / 8.0.5 or later and Vitest 3.2.7 / 4.1.10 or later. The 9.4 entered GitHub's database yesterday afternoon, so npm audit flags it now. The 8.7 isn't there.

CrewAI: a zero-day with no fix. In ZDI-26-706 (8.8, CVE-2026-92206), an application that loads an agent configuration from CrewAI's agent repository can run code planted in that configuration. ZDI reported it in October 2025, got no confirmation from CrewAI, and published it as a zero-day on September 16. This digest missed that notice; the CVE reached NVD yesterday. No CrewAI release, changelog entry or commit names a fix, and 1.15.28 (October 14) is current. ZDI's only mitigation is to restrict interaction with the product. Load agents only from repositories you control, and don't let user input choose which one.

NLTK 3.10.4 closes two path flaws. GHSA-j456 (8.6) let a caller who chooses the Weka classifier's model path read or write outside NLTK's data roots, and this digest has listed it as unfixed since September 29. GHSA-8mgp (7.0) is the same class across the other model APIs. 3.10.4, released yesterday, routes those paths through NLTK's path sandbox; the Weka module has no such check at 3.10.3. The release changes behaviour on purpose. Resources and model files load and save only inside the directories in nltk.data.path. nltk.data.load(..., format="pickle") rebuilds plain data only, and downloads are private to the installing account. Expect errors starting "Security Violation" where code relied on the old behaviour. The notes cite seven more advisory IDs that aren't published yet.

Also on the AI stack.

• LangGraph stores GHSA-6hmw (6.0 on v4): when untrusted input chooses a namespace label containing ., a read, delete or batch call in the Postgres or SQLite store can reach another tenant's items. Fixed in langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2 (October 12). The Agent Server rejects such labels from 0.15.5 and 0.16.2.
• nbconvert GHSA-pjvx (8.8 on v4): converting a malicious notebook to Markdown, LaTeX, reStructuredText or AsciiDoc can write files anywhere the converting user can, authorized_keys included. Fixed in 7.17.2 on October 12. This digest missed it then too.
• nginx-ui: ten advisories this morning, all fixed in 2.9.0 (October 17). Three are 8.8. An 8.1, GHSA-97pj, says July's fix to its MCP endpoint authentication was incomplete.
• Pydantic AI: in CVE-2026-114386 (6.3 on v4), the Harness CodeMode toolset didn't apply tool_calls_limit to nested tool calls; fixed in pydantic-ai-harness 0.59.0 (yesterday). In GHSA-5pfm (5.4), the UI adapters in 2.27.0 – 2.57.0 can run a tool call submitted by the client; fixed in 2.58.0. Take pydantic-ai 2.59.0, which also carries yesterday's 7.5.
• Hermes Agent CVE-2026-114463 (CERT/CC, not yet scored): a webhook route could be granted a different, higher-privileged route's toolsets. Only deployments that use the webhook gateway are in scope. The fix merged on September 18 and shipped in v2026.9.21; NVD's record names v0.22.2. The PyPI hermes-agent package stopped at 0.19.0 in July, so a scanner reading PyPI versions can't place a GitHub install.
• pypdf: more than twenty medium-severity denial-of-service advisories since August, three more yesterday. Take 6.21.2 (yesterday) wherever a RAG or ingestion pipeline parses PDFs it didn't create.
• Dependency caps. Streamlit 1.66.1 (yesterday) accepts Pillow 13 (pillow<14), so Streamlit apps can now take 13.0.0's 40 fixes. Gradio 6.30.0 and Open WebUI 0.12.3 still block it. MarkItDown 0.1.9 (yesterday) requires mammoth 1.12.2 or later, the denial-of-service fix its old ~=1.11.0 pin kept out since October 5.

On the Venicecom stack. Storybook is in the table. In OpenAPI.NET GHSA-m2pf (7.5), parsing an untrusted OpenAPI document, JSON or YAML, can exhaust the stack or memory and end the process. Microsoft.OpenApi and its readers are fixed in 1.6.31, 2.12.2 and 3.10.2, released August 20, and the patched readers' resource limits should stay on. That raises the floor from the 1.6.30 / 2.12.0 / 3.10.0 this digest gave on October 15. Semantic Kernel's OpenAPI plugin is where this meets the AI stack. 1.81.0 declares 1.6.31, but 1.80.0 and earlier declare 1.6.24, and NuGet restores the lowest declared version. Take 1.81.0, or reference Microsoft.OpenApi 1.6.31 directly. Microsoft.AspNetCore.OpenApi 10.0.13 requires 2.12.2. The record isn't in GitHub's database yet, so NuGetAudit says nothing. Angular hasn't released @angular/build since October 20, so its pinned Vite versions are unchanged. On .NET, CVE-2026-70197 is still at revision 2.0. Microsoft revised the October release document and seven older ones overnight without touching .NET, ASP.NET Core or Azure. No PrimeNG advisories today.

Paperwork your scanner may raise. A correction first. The three Vite records entered GitHub's database at 16:47 UTC yesterday, not on October 20 as this digest said; NVD had the CVEs on the 20th. npm audit has flagged them since yesterday afternoon. GitHub's database added 19 more Pillow records yesterday evening, so 28 of 41 are there now. GitHub rates three of them critical, above the project's own ratings: a Ghostscript argument injection the project called medium, and JPEG-decoder and TIFF-to-memory heap overflows it called high. The project's own two criticals, GHSA-v9pv (9.8) and the FlashPix overflow, still aren't. 13.0.0 fixes all of them except GHSA-654x, which now has CVE-2026-114501 and still no fix. Seven more virtualenv records reached the database, all fixed by the 21.14.9 floor from October 20. Jupyter Server CVE-2026-114135 (8.8) skips kernel execute authorization when a Gateway is configured. It was fixed in 2.6.0, and current releases are clear unless an application registers the deprecated jupyter_server.gateway.handlers module by hand. Google Agent Mesh's third advisory now has CVE-2026-103090 (8.8 on v4), fixed in 0.1.0-alpha.9 as noted on October 20. GitPython gained CVE-2026-114145 for the 3.2.1 fix from October 15, and LightRAG CVE-2026-114507 (fixed in 1.5.5). The D365 F&O MCP Server's CVE-2026-114123 (7.5) covers an Azure one-click deployment template that left the API key empty; 1.11.0 fixed it in August, so redeploy with a key if you used the template before then. The MCP Java SDK's three records and vLLM's nine from October 20 still aren't in the database.

Standing items. MLflow PR 26842 is still open, so CVE-2026-53995 has no fix; keep file-backed servers private. SGLang's four fix PRs (45017, 42098, 44314 and 44653) remain unmerged, and 0.5.22 is still the newest. DB-GPT is still on 0.8.2, with issue 3167 open. Xoscar 0.12.1 keeps XOSCAR_AUTH_KEY opt-in, and Xinference 4.0.1 still lacks the Windows path fix. picomatch PR 194 is open. On the eMudhra incident, CPython 3.15.1, 3.14.9 and 3.13.17, released yesterday, bundle pip 26.2.2, so python -m venv on those seeds a pip with the fixed certifi. 3.12 and older got no release, so pass --upgrade-deps there. uv 0.13.5 ships the updated managed Pythons (uv python upgrade), and Haystack 3.4.1 now requires certifi 2026.10.19. Unchanged: Archon 0.12.1, Kubeflow Model Registry 0.3.17, Chroma 1.5.9, Portkey AI Gateway 1.15.2, BotSharp, Unla 0.10.0, Plano 0.4.37, the MCP Kotlin SDK 0.15.0, Vearch 3.5.9, openapi-typescript-codegen 0.31.0, cc-connect, AstronRPA 1.1.6, Mooncake 0.3.13.post1, pandas-ai 3.0.0, LightLLM v1.2.0, GPT-SoVITS, Langchain-Chatchat 0.3.1.3, BentoML 1.4.39, BrowserSkill (PR 363 unmerged), hyper-mcp (nightlies only) and mcp-remote 0.15.2. LiteLLM 1.106.2, n8n 2.44.5 and the GitLab MCP server 2.3.6 shipped without advisories.