NEWSkillSec — elevating AI Skills security from malware detection to capability auditingSkillSecLearn more →
← Back to Intel Center
SECURITY INTEL · DAILY
RSS

2026-09-16 Daily Security Intelligence

CSSA 2 · CVE 2 · Poison 3

10.0 Critical · happy component uses a hard-coded key leading to remote identit…

CSSA Exclusive Early Warning 2

CSSA Exclusive Early Warning 10.0 Critical

happy component uses a hard-coded key leading to remote identity forgery and account takeover

An attacker uses the fixed development key published in the repository to derive valid authentication-signing material and construct a valid token that contains an arbitrary user ID. Because the server validates the token without querying session records and directly trusts the identity information inside the token, the attacker can impersonate an account, access sensitive data or decrypt stored third-party service credentials, compromising system confidentiality and integrity.

Component
happy is a backend service component that provides server-side encryption, persistent token generation and HMAC voice identification. Its architecture depends on a centralized HANDY_MASTER_SECRET as the core security primitive, aiming to unify identity authentication, data protection and third-party credential management across modules so that business logic can flow securely.
Type
Use of Hard-coded Cryptographic Key (CWE-321)
Repo
github.com/slopus/happy · Stars 23799
Remediation
  • Remove the hard-coded key; generate a unique high-entropy random key for each deployment; inject configuration through a protected key-management system; bind authentication tokens to server-side state so they can be revoked, and manage key lifecycle and purpose isolation.
CSSA Exclusive Early Warning 10.0 Critical

PraisonAI AgentApproval instruction injection bypasses safety approval and damages system integrity

AgentApproval does not isolate tool arguments and embeds malicious instructions in the parameters awaiting approval. The approval prompt concatenates the raw input directly, without delimiting untrusted data or stripping comments, so the review model is interfered with by internal instructions and incorrectly approves a malicious tool call, which may cause data tampering or service interruption.

Component
PraisonAI is a large-language-model-based intelligent-agent development framework. It includes a multi-agent tool-calling mechanism and a human-in-the-loop approval flow, and uses automated assessment of tool-call risk to protect system operations, especially by providing decision support for high-risk commands.
Type
Injection (CWE-74)
Repo
github.com/MervinPraison/PraisonAI · Stars 9058
Remediation
  • Wrap untrusted data with explicit delimiters and instruct the system prompt to ignore embedded instructions; implement comment filtering; and introduce a ternary judgment that escalates to human review, defaulting to reject or safely escalate potential injection requests.

CVE Intelligence 2

CVE-2026-59971 CVSS 10.0 Critical 2026-09-15

MySQL MCP Server unauthorized SQL injection leading to remote code execution

Before MySQL MCP Server 0.4.2, the SSE transport was not configured with security settings or DNS-rebinding protection; `/`, `/sse` and `/messages/` lacked authentication and bound to `0.0.0.0` by default. An attacker can call `execute_sql` without authorization, reach `cursor.execute(query)` through DNS rebinding, and read or modify the database. If the MySQL account has the FILE privilege, the attacker can also read and write server files and may achieve code execution. The default stdio transport is unaffected; 0.4.2 has the fix.

Component
MySQL MCP Server is a Model Context Protocol server that supports interaction with MySQL databases.
Risks
  • Unauthorized database access: An attacker can read, write or modify database contents without authentication
  • Remote code execution under FILE privilege: When the MySQL account has the FILE privilege, the attacker can read and write server files and may achieve code execution
  • DNS-rebinding attack: Combined with the default bind to 0.0.0.0 and the missing DNS-rebinding protection, the attack can reach an internal-network instance from the browser
Source
NVD · CVE-2026-59971
Remediation
  • Upgrade to 0.4.2 or later
  • Avoid using MCP_TRANSPORT=sse in production, or correctly enable security settings and DNS-rebinding protection
  • Restrict the bind address, avoid 0.0.0.0, and enforce network access control
CVE-2026-89308 CVSS 10.0 Critical 2026-09-15

Unauthorized OS command injection in the ping.php endpoint leading to remote code execution

Applications that include a ping.php endpoint do not strictly filter and neutralize input. A remote unauthenticated attacker can craft a malicious request to execute arbitrary operating-system commands, achieve RCE and fully control the server.

Component
ping.php is typically a network-diagnostics script that runs the ping command through an HTTP interface, commonly found in web admin backends and monitoring systems.
Risks
  • Complete system control: An attacker can execute arbitrary operating-system commands and fully control the server
  • Unauthenticated remote attack: The vulnerability can be exploited remotely without login
  • Lateral movement and backdoors: After obtaining code execution, the attacker can move laterally, implant backdoors and steal business data
Source
NVD · CVE-2026-89308
Remediation
  • Disable or remove unnecessary ping.php
  • Strictly validate allowlisted parameters and forbid special characters such as ; | & $
  • Use a safe API instead of direct system-command invocation, or enable sandbox isolation

Package Poisoning 3

Package Poisoning npm 2026-09-16

chai-as-crack@7.0.5 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
470721bc789bc76e1a57a9347e82b218
Package Poisoning npm 2026-09-16

kartykp-prod-oidc-test-pkg@1.0.4 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
ebc1e217592b58dd6acaff4f692c4cad
Package Poisoning npm 2026-09-16

kartykp-token-pkg@1.0.2 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
1a067f6dc811791ca91eebc063515888
← Back to Intel CenterRSSMonitor these risks automatically with CleanSource SCA →