@msaleme.bsky.social on Bluesky

JavaScript RequiredThis is a heavily interactive web application, and JavaScript is required. Simple HTML interfaces are possible, but that is not what this is. Learn more about Bluesky at bsky.social and atproto.com.

Post

Michael K. Saleme

msaleme.bsky.social

did:plc:binnh3oakzte6h6y347afnmx

Same vuln class is showing up all over MCP — wrote up CVE-2026-40933 (Flowise stdio RCE) this week. Three argv-validation guards still shipped CVSS 10.0 because the interpreter allowlist WAS the vulnerability. Your earlier CVE is the right prior to cite on the class.

2026-04-24T12:43:45.260Z