This month’s intelligence mainly presents four risk themes: trust-boundary issues in the MCP / agent toolchain, fail-open risk when security controls hit exception paths, SSRF from server-side URL fetches, and scoped packages, dependency confusion, and on-chain C2 (EtherHiding) in npm supply-chain poisoning.
Statistics
36 CSSA alerts, 46 CVE write-ups, 212 poisoning records (npm 210 / PyPI 2). Poisoning volume is far higher than the vulnerability notes and is almost all npm. The critical share is also high: some samples can directly trigger takeover, privilege escalation, or data exfiltration; risk severity cannot be judged by score alone. Year-over-year analysis should not rely only on total volume.
Trending
August CSSA and CVE records repeatedly include MCP, agent, and AI runtime issues. Many of the security problems relate to permission control, and the risk often already exists under the default configuration.
MetaMCP can over-read OAuth tokens and impersonate upstream; modelcontextprotocol / python-sdk have prompt injection and SSRF; hermes-agent has a run of issues (prompt injection, sandbox off, approval bypass, loose gateway auth); Claude Code can hurt the host when environment variables are not escaped or commands are wrapped loosely. Late-month samples of the same kind continued: unauthorized RCE via ArgoCD MCP, cc-connect webhook/admin missing auth plus command injection, ToolUniverse sandbox escape, and RCE in inference components such as ash_ai / lmdeploy. What needs attention is not a single MCP server: protocol, SDK, gateway, approval flow, CI/CD plugins, and inference services sit on one chain.
Another pattern: after a safety control fails, the system still allows the request. CubeSandbox / CubeOps with weak or missing auth lets admin tokens get forged; openssl_encrypt (CVE-2026-74901) falls back to unauthenticated AES-CTR when AES-GCM fails; Apache Superset MCP swallows exceptions and authentication effectively disappears; hermes-agent treats approval timeouts or interactive mode as obstacles the model can skip. In review, ask item by item: decrypt fail, auth error, approval timeout, sandbox not up — which branch does the code take?
SSRF was also common this month: SeaweedFS, Semantica, better-auth, TencentDB-Agent-Memory, sub2api, python-sdk, Adobe Campaign, and others are involved. What they share is that the server requests a URL on behalf of a user or agent, checks stay on the surface, and redirects or header forgery can bypass them. Crawl, preview, proxy download, image fetch, and webhook callbacks should be treated as high-risk surfaces at design time; do not wait for a CVE to be published before addressing them.
Of 212 poisoning records, almost all were npm. Several shapes keep recurring: scoped packages shipping in batches; internal enterprise names squatted on the public registry (for example sm-* commerce modules, internallib_v*); EtherHiding via @syncraft-labs/* (decode and execute from Ethereum transactions, C2 on-chain, a registry takedown does not remove it); plus high-version masquerading and anti-debug. Daily denylists are not enough; a pattern library is needed: scope families, confused names, on-chain payloads, private-name collisions.
Deep Dive
Poisoning still clusters on npm. Few PyPI records this month does not mean it is safer — we only saw fewer samples.
Agents / MCP often start with broad rights and weak approval. Multi-tenant components keep getting cross-tenant reads/writes from missing auth.
Unauthenticated RCE, SQL injection, and auth bypass are still common. Scheduling should not look only at CVSS; include exposure and reachability.
Summary
sm-*, internallib_v*, @syncraft-labs/*, and other August poison namesPublished by CleanSource Community ｜ Date: 2026-08-04
Sources: Sectrend CSSA vulnerability intelligence (270k+ advisories) · open source registry poisoning monitoring ｜ Please credit the source when redistributing
商务合作
微信公众号