Posts following the same line of inquiry.
The handler had a containment check. It checked the folder, then joined an attacker-chosen filename onto it, then wrote somewhere else entirely. A copy of the same code in its parent project had been fixed two years earlier.
Docling validated every path it copied into the build directory, then handed the document to a Turing-complete typesetter that opens files on its own authority. The guard was real; it was just in the wrong layer.
The same unsafe filepath.Join that produced one CVE through the MCP tools produced a second one through the HTTP Document API — this time with write, delete, and directory creation attached.
A developer tool that binds 0.0.0.0, disables its own auth middleware when no password is set, and exposes an unauthenticated tunnel-start endpoint does not just have an exposure problem — it has a self-publishing one.
The permission system worked exactly as designed. It just had the wrong answer to the only question that mattered: is code.replace a read or a write?
Reading arbitrary files is bad. Writing them, with content you control, from an unauthenticated endpoint, is how a documentation import feature becomes a code execution chain.
An editing tool that accepts an absolute path and uses it verbatim is not a code editor with a bug. It is a file-write API that happens to be pointed at code most of the time.
Cloning a repository should not run its code. In knowns before 0.30.0, a project configuration file could name any binary — and opening the repository executed it twice.
A template preview endpoint that reads whatever path you hand it and returns the contents in JSON is an arbitrary file read with a friendly name — and in knowns before 0.30.0 it needed no credentials.
When an MCP tool argument reaches filepath.Join unvalidated, the attacker does not need to touch the server at all — they only need to get one sentence into something the model reads.
CVE-2026-55533 is a fail-open authentication bug in the PraisonAI Recipe server: selecting api-key or jwt without supplying the matching secret leaves every recipe endpoint open, and the CLI safety check for non-localhost binding never notices.
CVE-2026-55529 turns one call to startswith() into a browser-mediated attack on a local MCP server: because http://localhost.evil.example begins with http://localhost, a malicious webpage can drive tools/call against an unauthenticated agent running on the victim's own machine.