---
id: 2026-09-ro1me-open-source-agent-framework-llm-output-execution-cve-wave
title: "Eight MITRE-assigned CVEs land at once (2026-09-30 / 10-01) for one researcher's May 2026 GitHub issues against open-source agent frameworks that execute model output or user code directly — Devika (two 9.8s), DeepTutor (9.8), DB-GPT skill upload → execution (9.8), AgentScope RealtimeAgent execute_python_code over WebSocket (9.8), agent-zero file browser rooted at / (7.5 + one unscored), Langflow /api/v1/validate/code compile+exec (unscored); most issues have no maintainer reply and none names a fixed version; thirteen more MITRE ids for the same gists followed on 10-01/02 (Devika ×3, Langchain-Chatchat ×3, SuperAGI ×4, AgentScope, Langflow) plus a VulDB 9.3 for InternLM MindSearch"
date_disclosed: 2026-09-30
last_updated: 2026-10-06
severity: critical
status: unconfirmed
ecosystems: [pypi, github, ai-agents, python]
tools_affected: ["Devika v1.0 (stitionai/devika)", "DeepTutor v1.4.0 (HKUDS/DeepTutor)", "DB-GPT 0.7.5 and 0.8.0 (eosphoros-ai/DB-GPT)", "AgentScope 1.0.18–1.0.19 (agentscope-ai/agentscope)", "agent-zero 1.7–1.10 (agent0ai/agent-zero)", "Langflow ≤ 1.9.3 (langflow-ai/langflow)", "Langchain-Chatchat 0.3.0–0.3.1 (chatchat-space)", "SuperAGI ≤ 0.0.14 (TransformerOptimus)", "AgentScope 1.0.20", "InternLM MindSearch 0.1.0 (CVE-2026-105135, VulDB 9.3)"]
tags: [cve-wave, agent-framework, llm-output-execution, code-injection, rce, path-traversal, skill-upload, websocket, no-vendor-advisory, mitre-cna, single-reporter, unpatched]
---

## TL;DR

Between **2026-09-30 and 10-01** MITRE published eight CVEs, all citing GitHub issues and gists filed by one researcher (**Ro1ME**) in **April–May 2026**, against six open-source agent frameworks that people fork, self-host and build "AI coworkers" on: **Devika** executes LLM-generated content in `Runner.execute` / `Runner.run_code` (CVE-2026-51871, **9.8**; CVE-2026-51872); **DeepTutor**'s TutorBot `ExecTool` pipes model-generated shell commands into a subprocess from a WebSocket chat (CVE-2026-51870, **9.8**); **DB-GPT** runs a script uploaded through `/api/v1/skills/upload` when the react-agent chat later calls it (CVE-2026-51866, **9.8**); **AgentScope**'s `RealtimeAgent` lets a remote WebSocket user prompt the agent into `execute_python_code` with no approval or isolation step (CVE-2026-51856, **9.8**); **agent-zero**'s file browser is rooted at the host filesystem root and accepts unnormalised paths (CVE-2026-51853, **7.5**; CVE-2026-51852); and **Langflow**'s `/api/v1/validate/code` forwards raw Python into `compile()`/`exec()` behind authentication (CVE-2026-51886). None of the CVE records names a fixed version; four of the six issues show **no maintainer reply**; DB-GPT has a linked fix PR and Langflow assigned a maintainer. These are the "an agent is a remote shell with a chat UI" class — if you self-host any of them, put an OS boundary under it today and assume the model's output is attacker input.

## What happened

**The source shape.** None of this came through a vendor advisory tab, a security blog or a CNA that validates fixes. MITRE (`cve@mitre.org`) assigned the ids in bulk and the only references are the reporter's GitHub issue and a gist per bug. The issues were opened **2026-04-20 (agent-zero)**, **05-05 (AgentScope)**, **05-07 (DB-GPT)**, **05-23 (Devika, DeepTutor)** and **05-26 (Langflow)** — four to five months before the CVEs. The advisory database's `agent` and `llm` recency listings showed them on 09-30 as unreviewed entries with no package metadata; the NVD keyword window for `langflow` surfaced the eighth on 10-01. Per this repo's rule for small projects with no advisory channel (`LEARNINGS.md` §10), the detailed issue is the primary and the CVE assignment is the second signal — so the status is **`unconfirmed`**, stated plainly: no vendor has confirmed, scored or fixed these in a form this sweep could read.

**Per project (CVE record text, then what the issue page shows):**

| Project / CVE | The bug (NVD description, abridged) | CVSS | Issue status (fetched 2026-10-01) |
|---|---|---|---|
| **Devika v1.0** — CVE-2026-51871 | `Runner.execute` in `src/agents/runner/runner.py` "allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content" | **9.8** | Issue #714 (05-23): open, no reply, no fix. Reporter demonstrates a two-turn prompt-injection flow that writes a marker file. |
| **Devika v1.0** — CVE-2026-51872 | Code injection via `Runner.run_code` in the same file | unscored | Issue #715 (05-23): sibling report. |
| **DeepTutor v1.4.0** — CVE-2026-51870 | Command execution in `/tutorbot/agent/tools/shell.py:ExecTool.execute` | **9.8** | Issue #506 (05-23): closed, labelled bug, no maintainer text, no fix PR shown. Reporter: LLM-generated commands go to `asyncio.create_subprocess_shell` from the WebSocket chat. |
| **DB-GPT 0.7.5 / 0.8.0** — CVE-2026-51866 | "a skill uploaded through the real `/api/v1/skills/upload` route can later be executed through the real `/api/v1/chat/react-agent` flow" | **9.8** | Issue #3047 (05-07): closed with **linked PR #3071**; labels "bug", "Waiting for reply". The only one of the six with a visible fix path. Which release carries #3071 is not stated. |
| **AgentScope 1.0.18–1.0.19** — CVE-2026-51856 | When a `RealtimeAgent` session exposes `execute_python_code`, "a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment"; `RealtimeAgent._acting` forwards the model's tool call to `Toolkit.call_tool_function` "without an additional approval or isolation boundary" | **9.8** | Issue #1563 (05-05): open, no reply, no fix. PyPI shows 1.0.20 (05-15), 1.0.21 (05-25) and a 2.x line (latest 2.0.9); nothing this sweep read says any of them changes the path. |
| **agent-zero 1.7–1.10** — CVE-2026-51853 | `FileBrowser.__init__` "initializes with the host root directory as the workspace, allowing the agent to access any file on the system" | **7.5** | Issue #1539 (04-20): closed, no visible reply, no linked fix. |
| **agent-zero 1.7–1.10** — CVE-2026-51852 | `FileBrowser.save_file_b64` accepts user-controlled paths without normalisation (traversal) | unscored | Issue #1540 (04-20). |
| **Langflow ≤ 1.9.3** — CVE-2026-51886 | `/api/v1/validate/code` "accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard" (authenticated) | unscored | Issue #13336 (05-26): closed, labels "bug" + "security", assigned to a maintainer; no fix version named. Langflow has since shipped 1.10–1.12 and an [eleven-CVE IBM bulletin](2026-09-langflow-ibm-psirt-eleven-cve-batch.md); whether this endpoint changed is not stated in anything fetched. |

**What the class is.** Every entry is a variant of the same design: the framework gives the model (or an authenticated user, or a WebSocket peer) a tool that runs code or shell on the server, and treats the model's choice to call it as authorisation. That is the [PraisonAI](2026-05-praisonai-auth-bypass.md) / [Flowise](2026-04-flowise-rce-cluster.md) / [Langflow](2026-07-langflow-cve-2026-0770-exec-globals-rce.md) pattern this corpus has filed a dozen times, now with a CNA-assigned id attached to each of five more projects. The practical difference from a "normal" CVE: there is no patch to pull, so the only remediations are architectural.

**What this corpus does not know.** Whether any maintainer disputes the reports; whether DeepTutor's and agent-zero's closed issues were closed as fixed, as by-design, or as stale; and whether Langflow's 1.10+ releases touched `validate/code`. Treat the version ranges as "reported against," not "known to end at."

## Am I affected?

You are in scope if you self-host any of the six — including as a fork, a Docker image, or a "deploy this agent" template — and anyone other than you can reach its API or WebSocket.

```bash
# Which of these are installed, and at what version?
pip show agentscope langflow 2>/dev/null | grep -E '^(Name|Version):'
for d in devika DeepTutor DB-GPT agent-zero; do [ -d "$d" ] && (cd "$d" && git log -1 --format="$d %h %cd"); done
docker ps --format '{{.Image}}' | grep -iE 'devika|deeptutor|db-gpt|dbgpt|agentscope|agent-zero|langflow'

# Is the code-execution surface reachable? (any non-loopback bind = reachable)
ss -ltnp | grep -E ':(1337|3000|5000|5670|7860|8000|8080|8501)\b'
# agent-zero: is the file browser rooted at / ?
grep -n 'FileBrowser' -r agent-zero/python/helpers/file_browser.py 2>/dev/null | head -3
# AgentScope: is execute_python_code registered on any RealtimeAgent toolkit?
grep -rn 'execute_python_code' --include='*.py' . | grep -v site-packages | head
# Langflow: the endpoint exists on every version; what matters is who holds an API key / login
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:7860/api/v1/validate/code
```

## If you are affected

1. **Bind to loopback or a private network now**, put authentication in front if the framework has none, and put the whole thing in a container or VM with no ambient cloud credentials — the model's code-execution tool runs *as the service*, so the service must own nothing you care about. → [playbooks/if-your-local-ai-agent-was-exploited.md](../playbooks/if-your-local-ai-agent-was-exploited.md), [prevention/agent-sandboxing.md](../prevention/agent-sandboxing.md)
2. If an instance was internet-reachable: treat it as compromised, rotate every key in its environment and `.env` → [playbooks/rotating-cloud-credentials.md](../playbooks/rotating-cloud-credentials.md), and audit the data it could read (DB-GPT and Langflow hold database and provider credentials by design).
3. Watch the issue links below rather than a CVE feed for the fix; MITRE records will not be updated when a maintainer merges something.

## Prevention

- **Model output is attacker input.** A tool that executes code must sit behind an approval step the *user* takes, in a sandbox the *framework* does not control — never gated by the model's own decision to call it. [prevention/agent-sandboxing.md](../prevention/agent-sandboxing.md)
- For anything with a WebSocket or HTTP agent endpoint, the question "who can open a session?" is the whole security model; default binds and example `docker run` lines in READMEs are routinely `0.0.0.0` with auth off (see Obot in the [MCP/agent batch](2026-08-agent-framework-mcp-cve-batch.md)).
- When you fork a research framework into a product, the "File browser rooted at `/`" and "`trust_remote_code=True` by default" class of convenience defaults ships with it; [playbooks/auditing-a-vibe-coded-repo.md](../playbooks/auditing-a-vibe-coded-repo.md) lists what to grep for first.

## Update — 2026-10-04: thirteen more MITRE ids for the same reporter's gists landed on 10-01/02 — Devika ×3, Langchain-Chatchat ×3, SuperAGI ×4, AgentScope, Langflow — and a different reporter's VulDB record gives InternLM MindSearch a 9.3 with "the vendor … did not respond in any way"; HKUDS's other agent (Vibe-Trading) shows what the fixed version of this story looks like

The wave did not stop at eight. Between **2026-10-01 and 10-02** MITRE published thirteen further CVEs whose only references are `gist.github.com/Ro1ME/…` (plus, for Langflow, the already-tracked issue #13336). NVD carries a CVSS for only one of them (CVE-2026-51899, 4.3, from the CISA ADP); none names a fixed version or a maintainer reply.

| Product | Ids (all `cve@mitre.org`, 10-01/02) | What the record says |
|---|---|---|
| **Devika v1.0** | CVE-2026-51873, -51874, -51875 | `save_code_to_project` in the Coder, Patcher and Feature agents writes "files outside the intended project workspace" — path traversal in three agents that share one helper; sits beside the two 9.8 code-injection ids above. |
| **Langchain-Chatchat 0.3.0 / 0.3.1** | CVE-2026-51882, -51883, -51884 | the OpenAI-compatible `/v1/files` upload, knowledge-base creation/document upload, and `/knowledge_base/upload_temp_docs` all take attacker-controlled filenames into host file writes. New product for this file: a widely forked Chinese-language RAG/chat framework. |
| **SuperAGI ≤ 0.0.14** | CVE-2026-51899 (4.3), -51901, -51904, -51914 | controller endpoints (`/api/agents/create`, `/schedule`, `/delete`, `/edit_schedule`, `/stop_schedule`), `/api/agentexecutions/schedule`, `create_agent_execution` and the agent-template controller lack per-organisation access control — authenticated users act on other tenants' agents. |
| **AgentScope 1.0.20** | CVE-2026-51922 | `execute_shell_command` (`src/agentscope/tool/_coding/_shell.py`) code injection — the shell twin of the RealtimeAgent `execute_python_code` id above, one version later. |
| **Langflow ≤ 1.8.4** | CVE-2026-51888 | absolute-path traversal in `knowledge_bases.py:create_knowledge_base` → "arbitrary file write outside the intended workspace or storage boundary." Gist only, no issue; Langflow's own tab (walked 2026-10-04) has 09-28 entries for other bugs and nothing for this or for `/api/v1/validate/code`. |

**InternLM MindSearch 0.1.0 — CVE-2026-105135** (CNA VulDB, published **2026-10-04**, CVSS 4.0 **9.3** / 3.1 10.0, CWE-74): "`ExecutionAction.run` of the file `mindsearch/agent/graph.py` of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. **The vendor was contacted early about this disclosure but did not respond in any way.**" Reference is a gist by a different reporter (DReazer). Same class — a planner that executes model-generated code — different researcher, different CNA, same outcome: no fix, no reply.

**The counter-example.** HKUDS, the org behind DeepTutor (two ids above, issue unanswered), also publishes **Vibe-Trading** (`vibe-trading-ai` on PyPI), an LLM trading-agent framework. Its maintainers issued **three vendor advisories on 2026-07-29** (database-reviewed 2026-10-02): [GHSA-v2f8-6655-7grj](https://github.com/advisories/GHSA-v2f8-6655-7grj) (Critical, CVSS 3.1 9.8 / 4.0 10.0 — the auth dependency "returns immediately when `API_AUTH_KEY` is unset," leaving every endpoint open, with upload and an RCE-as-root chain), GHSA-jqmf-mx4f-hfr6 (Critical — "LLM-callable tools permit command execution, code injection, and SSRF") and GHSA-5rmq-chc7-m22f (High — file-read tools expose arbitrary server files); all **fixed in 0.1.7**. It is out of this corpus's audience as a trading bot, but it is the same org, the same class of bug, and the version of the process that ends with a fix line — which is why it is here as the contrast. Status of this file stays `unconfirmed`: twenty-one ids, one CVSS from a third party, zero maintainer statements.

## Update — 2026-10-05: two more ids on 10-02 for a seventh framework, FinRobot 1.0.0 (CVE-2026-51917, CVE-2026-51918) — code injection in `CodingUtils.modify_code` and `CodingUtils.create_file_with_code`; VulnCheck's SiYuan and Heym ids are tracked elsewhere

The NVD keyword window for `coding` (10-02 → 10-05) surfaced two further `cve@mitre.org` records published **2026-10-02** against **FinRobot 1.0.0** (AI4Finance Foundation's LLM financial-agent framework): CVE-2026-51917, "vulnerable to Code Injection in `CodingUtils.modify_code`," and CVE-2026-51918, "code injection in `CodingUtils.create_file_with_code()`." Both descriptions are one sentence, neither carries a score, neither names a fixed version, and the id block sits inside the same 5185x–5192x range as the rest of this wave, so this sweep lists them here rather than opening a new file; the gist references were not opened and no FinRobot issue was located. The pattern is the file's thesis in miniature — a helper that writes model-generated code to disk and runs it, reachable from a chat turn. Status unchanged (`unconfirmed`). The 10-04 and 10-05 VulnCheck ids for SiYuan (CVE-2026-105205) and Heym (CVE-2026-105396, HITL review-token leak via a spoofable `Origin` header, 5.3, fixed 0.0.112) belong to products already tracked in the [MCP batch](2026-08-agent-framework-mcp-cve-batch.md) and are noted there by reference only.

## Update — 2026-10-06: SuperAGI's share of the wave is six ids, not four — CVE-2026-51904 (9.8) and CVE-2026-51915 (9.8) for agent-execution and tool controllers that take a caller-supplied id without checking the organisation, CVE-2026-51914 (8.8, agent templates), CVE-2026-51901 (8.1, scheduling another organisation's agents), CVE-2026-51916 (7.5, deleting any knowledge object) and the 51899 (4.3) already listed; all against v0.0.14, all scored by CISA's ADP, none with a fix

The NVD keyword query for `SuperAGI` (published 2026-10-02) returns **six** `cve@mitre.org` records, and the database's `agent` recency listing shows GHSA entries for four of them on 10-02 (GHSA-63jh-v3gf-wqcq for 51904 among them). All six describe the same defect in different controllers of TransformerOptimus/SuperAGI "up to v0.0.14": an endpoint "accept[s] a caller-supplied `agent_id`" (or `tool_id`, or `knowledge_id`) "and fail[s] to verify organization ownership," so an authenticated user in one organisation acts on another's objects. The scores are CISA-ADP's, not the CNA's: **CVE-2026-51904 9.8** (`create_agent_execution` / `create_agent_run` in `controllers/agent_execution.py`), **CVE-2026-51915 9.8** (`get_tool` / `update_tool`), **CVE-2026-51914 8.8** (`save_agent_as_template` / `publish_template`), **CVE-2026-51901 8.1** (`/api/agentexecutions/schedule`), **CVE-2026-51916 7.5** (`POST /knowledges/delete/{knowledge_id}`), **CVE-2026-51899 4.3** (the five `/api/agents/*` controller endpoints). References are the reporter's gists and, for two of them, SuperAGI issues #1556 and #1557. Nothing names a fixed version; the project's last release predates the reports. Status unchanged (`unconfirmed`, single reporter, no vendor response); the SuperAGI block in the tools list above should be read as "≤ 0.0.14, six ids." These are multi-tenant authorization failures rather than the model-output-execution sink that is this file's thesis, and are kept here only because they belong to the same reporter's same-day batch.

## Sources

- [NVD API — CVE-2026-51871](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-51871), [CVE-2026-51872](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-51872), [CVE-2026-51870](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-51870), [CVE-2026-51866](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-51866), [CVE-2026-51856](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-51856), [CVE-2026-51853](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-51853), [CVE-2026-51852](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-51852), [CVE-2026-51886](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-51886) — CNA `cve@mitre.org`, published 2026-09-30 (CVE-2026-51886 on 2026-10-01); descriptions, CVSS 3.1 scores where present (9.8 ×4, 7.5 ×1), and the issue/gist references quoted above. Queried 2026-10-01.
- [stitionai/devika #714](https://github.com/stitionai/devika/issues/714), [agent0ai/agent-zero #1539](https://github.com/agent0ai/agent-zero/issues/1539), [HKUDS/DeepTutor #506](https://github.com/HKUDS/DeepTutor/issues/506), [eosphoros-ai/DB-GPT #3047](https://github.com/eosphoros-ai/DB-GPT/issues/3047), [agentscope-ai/agentscope #1563](https://github.com/agentscope-ai/agentscope/issues/1563), [langflow-ai/langflow #13336](https://github.com/langflow-ai/langflow/issues/13336) — the reporter's issues: open dates, open/closed state, labels, assignee, the DB-GPT fix PR #3071, and the absence of maintainer replies on Devika, agent-zero, DeepTutor and AgentScope. Fetched 2026-10-01.
- [GitHub Advisory Database — `agent`, sorted by published date](https://github.com/advisories?query=agent+sort%3Apublished-desc) and [`llm`](https://github.com/advisories?query=llm+sort%3Apublished-desc) — the 2026-09-30 unreviewed entries (GHSA-j6rq-qhh6-gpf5, GHSA-h2gv-ghr5-8mhj, GHSA-23c2-f3h2-xmcw, GHSA-pxxm-r9vp-9cmm, GHSA-4q5p-v9jh-hg59, GHSA-5656-fcv7-9pxx, GHSA-8v8q-vxfm-pcf6) with severity labels only. Fetched 2026-10-01.
- [PyPI — agentscope release history](https://pypi.org/pypi/agentscope/json) — queried 2026-10-01: 1.0.18 (2026-03-26), 1.0.19 (04-20), 1.0.20 (05-15), 1.0.21 (05-25); latest 2.0.9. No release note read by this sweep mentions the RealtimeAgent path.
- **2026-10-05 update source** — [NVD API keyword window `coding`, 10-02 → 10-05](https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=coding&pubStartDate=2026-10-02T00:00:00.000&pubEndDate=2026-10-05T23:59:59.999) — CVE-2026-51917 and CVE-2026-51918 (FinRobot 1.0.0, `cve@mitre.org`, published 2026-10-02, no CVSS, no fixed version); [CVE Services — CVE-2026-105396](https://cveawg.mitre.org/api/cve/CVE-2026-105396) (Heym, VulnCheck, 2026-10-05, 5.3, fixed 0.0.112).
- **2026-10-04 update sources** — [NVD API keyword window 10-01 → 10-04](https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=agent&pubStartDate=2026-10-01T00:00:00.000&pubEndDate=2026-10-04T23:59:59.999) and the `Coder`, `LangChain`, `Langflow` keyword queries — CVE-2026-51873/-51874/-51875 (Devika), -51882/-51883/-51884 (Langchain-Chatchat), -51886 (re-fetched: `validate.py` text now carries the `¶¶` duplicate description) and -51888 (Langflow 1.8.4, gist `c85f513d`), -51899 (4.3 CISA-ADP)/-51901/-51904/-51914 (SuperAGI), -51922 (agentscope 1.0.20), all `cve@mitre.org` published 2026-10-01/02; [NVD API — CVE-2026-105135](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-105135) (VulDB, 2026-10-04, 9.3 / 10.0, the "did not respond" sentence, gist by DReazer) and [GHSA-4535-w5r2-pmqp](https://github.com/advisories/GHSA-4535-w5r2-pmqp); [GitHub Advisory Database — `agent`, sorted by published date](https://github.com/advisories?query=agent+sort%3Apublished-desc) (SuperAGI ×4 and Devika ×2 entries dated 10-02 with severity "Unknown"); [GHSA-v2f8-6655-7grj](https://github.com/advisories/GHSA-v2f8-6655-7grj) (Vibe-Trading, vendor 2026-07-29, 9.8 / 10.0, `API_AUTH_KEY`, ≥ 0.1.0 < 0.1.7 → 0.1.7) and the [`llm` listing](https://github.com/advisories?query=llm+sort%3Apublished-desc) for the two sibling ids; [langflow-ai/langflow advisory tab](https://github.com/langflow-ai/langflow/security/advisories?state=published) (walked 2026-10-04: newest 09-28, nothing for `validate/code` or `knowledge_bases`). All queried/fetched 2026-10-04.
- [NVD API — keywordSearch=SuperAGI, published 2026-09-28 → 10-06](https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=SuperAGI&pubStartDate=2026-09-28T00:00:00.000&pubEndDate=2026-10-06T23:59:59.999) — fetched 2026-10-06: six records published 2026-10-02 (CVE-2026-51899, -51901, -51904, -51914, -51915, -51916), CNA `cve@mitre.org`, CVSS from the CISA-ADP container, descriptions and gist/issue references as quoted.
- [GHSA-63jh-v3gf-wqcq — SuperAGI up to v0.0.14 contains an improper access control vulnerability (CVE-2026-51904)](https://github.com/advisories/GHSA-63jh-v3gf-wqcq) — fetched 2026-10-06: 9.8, unreviewed, the `create_agent_execution` / `create_agent_run` description, published 2026-10-02.