---
id: 2026-10-lasso-vulncheck-seventeen-cve-agent-platform-wave-deep-agents-ungated-shell-tools
title: "Lasso Security wave: seventeen VulnCheck CVEs across twelve agent platforms, eleven RCE-class, three with a fix referenced (2026-10-15 to 10-20)"
date_disclosed: 2026-10-20
last_updated: 2026-10-20
severity: critical
status: active
ecosystems: [python, pypi, agent-frameworks, agent-platforms, self-hosted, github-source, deepagents]
tools_affected: ["DB-GPT through 0.8.2 (eosphoros-ai), PyPI dbgpt 0.8.2 is the newest release", "Letta through 0.16.8 (letta-ai), the newest repository tag", "Langchain-Chatchat through 0.3.1.3", "piflow 2.0.0 through 2.0.1 (cas-bigdatalab)", "Cognition before 0.13.0 (CognicellAI)", "EvoScientist 0.1.0 before 0.2.5", "Coze Studio before 0.5.0 and through 0.5.1 (coze-dev)", "Aix-DB 1.2.4 (apconw)", "JoySafeter through 1.0.0 (jd-opensource)", "OpenSRE through 0.1.2026.10.19 (Tracer-Cloud)", "LangAlpha through 2026.09.07 (ginlix-ai)", "MoviePilot 3.1.5 (jxxghp)", "any app built on LangChain Deep Agents that exposes an execute or shell tool without an approval gate"]
tags: [cve, agent-framework, rce, prompt-injection, authentication-bypass, insecure-default, cross-tenant, vulncheck, lasso-security, deepagents, wave, no-fix, excessive-agency]
---

## TL;DR
Between 2026-10-15 and 2026-10-20 VulnCheck published seventeen CVE records against twelve self-hosted agent platforms, every one referencing a Lasso Security vulnerability-database page and, where VulnCheck names reporters, credited to Noy Pearl, Michael Sromin and Ophir Dror. Eleven are RCE-class: four unauthenticated (DB-GPT CVE-2026-77932, Langchain-Chatchat CVE-2026-75128, piflow CVE-2026-109442, Cognition CVE-2026-109437), three reached by indirect prompt injection through content the agent reads (EvoScientist CVE-2026-77930, OpenSRE CVE-2026-109444, LangAlpha CVE-2026-109440), and four for any authenticated user (Aix-DB CVE-2026-77926, JoySafeter CVE-2026-109443, Coze Studio CVE-2026-77934, MoviePilot CVE-2026-77931). Only three records reference a fix (Cognition v0.13.0, EvoScientist v0.2.5, Coze Studio 0.5.0); for the other nine products the record's upper bound is the current release and no vendor advisory, security tab entry or maintainer reply was found. Four of the records name LangChain's Deep Agents framework, whose `execute` or shell tool the app runs with no approval gate, and a fifth (OpenSRE) matches the pattern; the framework's own two October advisories are in [the Deep Agents file](2026-10-deepagents-filesystem-rule-alternate-path-bypass-acp-always-allow-shell-bypass-ghsa-pair.md).

## What happened

Lasso Security runs a public "vulnerability database" of findings against LLM apps, agents and MCP servers. On 2026-10-20 it listed 21 entries dated 2026-08-24 to 2026-10-18, each tagged "Agentic AI" with an attack-type label and a CVSS figure. VulnCheck, acting as CNA, published records for seventeen of them between 2026-10-15 and 2026-10-20, and every record's first reference is the Lasso page. The two VulnCheck pages opened this run (DB-GPT, Letta) credit Noy Pearl, Michael Sromin and Ophir Dror; the Lasso pages name no reporter. IntentKit's CVE-2026-76066 (2026-10-13), from the same reporters, is in [its own file](2026-10-intentkit-executor-owner-only-tool-authorization-bypass-cve-2026-76066.md). The three remaining Lasso entries are not VulnCheck records: Astron Agent CVE-2026-108263 and MaxKB CVE-2026-77521 are GitHub-CNA vendor advisories already in this corpus, and the Yuxi id Lasso prints (CVE-2026-97693) does not exist on CVE Services as of 2026-10-20.

The records, from CVE Services (`cveawg.mitre.org`) on 2026-10-20, with the CNA's CVSS 4.0 and 3.1 scores:

| CVE | Product (vendor) | Record title, shortened | Affected | 4.0 / 3.1 | Fix referenced | CNA date |
|---|---|---|---|---|---|---|
| CVE-2026-77932 | DB-GPT (eosphoros-ai) | unauthenticated RCE via `/api/v1/chat/react-agent`; a mock `get_user_from_headers` grants every caller admin | through 0.8.2 | 9.3 / 9.8 | none | 10-20 |
| CVE-2026-77933 | DB-GPT | hardcoded MySQL root credentials in the `docker-compose.yml` deployment | through 0.8.2 | 9.3 / 9.8 | none | 10-20 |
| CVE-2026-77936 | Letta (letta-ai) | insecure default configuration: unauthenticated API and PostgreSQL access | through 0.16.8 | 9.3 / 9.8 | none | 10-20 |
| CVE-2026-77937 | Letta | cross-tenant impersonation via a self-asserted `user_id` header, even with `LETTA_SERVER_SECURE` | through 0.16.8 | 8.6 / 8.1 | none | 10-20 |
| CVE-2026-77938 | Letta | credential exposure via tool-sandbox environment inheritance | through 0.16.8 | 7.1 / 6.5 | none | 10-20 |
| CVE-2026-75128 | Langchain-Chatchat (chatchat-space) | unauthenticated RCE via the `/tools/call` endpoint | through 0.3.1.3 | 9.3 / 9.8 | none | 10-20 |
| CVE-2026-109442 | piflow (cas-bigdatalab) | unauthenticated RCE: `POST /chat` and `/chat/stream` drive a DeepAgents chat agent whose `exec_shell` tool has no approval or allow-list | 2.0.0 through 2.0.1 | 9.3 / 9.8 | none | 10-20 |
| CVE-2026-109437 | Cognition (CognicellAI) | unauthenticated RCE: agent sandbox backend defaults to local execution and the REST/SSE API ships no authentication | before 0.13.0 | 9.2 / 9.8 | v0.13.0 release | 10-19 |
| CVE-2026-77930 | EvoScientist | human-approval bypass: async sub-agents lack the `interrupt_on` gate, so instructions in fetched web pages run host commands | 0.1.0 before 0.2.5 | 8.7 / 8.8 | v0.2.5 release, commit d249e32 | 10-20 |
| CVE-2026-109444 | OpenSRE (Tracer-Cloud) | approval-gate bypass: the headless presenter's `execution_allowed()` always returns true, so injected alerts or Slack messages run `shell_run` | through 0.1.2026.10.19 | 8.7 / 8.8 | none | 10-20 |
| CVE-2026-109440 | LangAlpha (ginlix-ai) | indirect prompt injection to RCE: `Bash` and `ExecuteCode` have no allow-list or approval, vault secrets readable | through 2026.09.07 | 8.6 / 8.1 | none | 10-20 |
| CVE-2026-109441 | LangAlpha | cross-tenant sandbox exposure: all tenants' containers on Docker's default bridge with inter-container communication on | through 2026.09.07 | 6.9 / 5.8 | none | 10-20 |
| CVE-2026-77926 | Aix-DB (apconw) | authenticated non-admin RCE through the ChatBI common agent's ungated deepagents `execute` tool | 1.2.4 | 8.7 / 8.8 | none | 10-20 |
| CVE-2026-109443 | JoySafeter (jd-opensource) | authenticated RCE: self-registered users select "standard mode" and the Copilot's `execute` tool runs `subprocess.run` with `shell=True` | through 1.0.0 | 8.7 / 8.8 | none | 10-20 |
| CVE-2026-77934 | Coze Studio (coze-dev) | RCE via an unsandboxed local Python code runner | before 0.5.0 | 8.7 / 8.8 | commit fcf40d1 | 10-20 |
| CVE-2026-77935 | Coze Studio | cross-space workflow IDOR in the workflow API handlers | through 0.5.1 | 8.7 / 8.3 | none | 10-20 |
| CVE-2026-77931 | MoviePilot (jxxghp) | command injection via `ExecuteCommandTool` | 3.1.5 | 8.7 / 8.8 | none | 10-15 |

The shape is the one this corpus has filed since [the Ro1ME wave](2026-09-ro1me-open-source-agent-framework-llm-output-execution-cve-wave.md) and [the VulnCheck single-researcher wave](2026-10-vulncheck-single-researcher-agent-mcp-gateway-cve-wave-mini-swe-agent-env-leak.md): a chat or alert endpoint, a model that can call a shell tool, and no gate between the two. What is new is the framework under it. The piflow, Cognition, Aix-DB and EvoScientist records name LangChain's Deep Agents (`deepagents`), and OpenSRE's "headless presenter" is the same pattern: the framework ships an `execute` tool and an interrupt mechanism, and the app either does not configure the interrupt or wires a presenter that approves everything. Deep Agents itself published two advisories in October for cases where its own rules can be bypassed; those are in [the Deep Agents file](2026-10-deepagents-filesystem-rule-alternate-path-bypass-acp-always-allow-shell-bypass-ghsa-pair.md).

Version and fix checks, 2026-10-20:

- **DB-GPT.** PyPI `dbgpt` 0.8.2 (2026-08-26) is the newest release and the record's upper bound, so the current release is affected. The September Ro1ME file already carries DB-GPT's skill-upload CVE-2026-51866; these two are different endpoints.
- **Letta.** The repository's newest tag is v0.16.8 (2026-05-14), which is the record's upper bound, so the current release is affected. PyPI `letta` is at 0.34.12 (2026-10-12) on a different version scheme that the records do not reference, so no "upgrade to" line can be derived from the registry. The repository's security tab is empty. The v0.16.8 release notes carry an unrelated pickle-to-JSON transport fix.
- **Cognition.** The Lasso page says the local shell backend is disabled in v0.13.0 unless explicitly enabled. The v0.13.0 release notes (2026-07-27) say production settings "fail closed for unsupported host/local execution" and that model-directed execution no longer "silently fall[s] back to host-local paths"; the notes do not mention authentication on the REST/SSE API, so put the API behind an authenticating proxy regardless.
- **EvoScientist.** The v0.2.5 release notes (2026-08-01) say human-in-the-loop approval now covers sync and async sub-agents under one policy and that async agents refuse pipe-into-interpreter commands. PyPI `evoscientist` is at 0.3.7.
- **Coze Studio.** CVE-2026-77934's range ends before 0.5.0 and references a fix commit; CVE-2026-77935 reaches 0.5.1 with no fix. The repository's security tab is empty.
- **OpenSRE and LangAlpha.** The records use date-shaped versions (`0.1.2026.10.19`, `2026.09.07`) that read as the newest commit reviewed; PyPI `opensre` is at 2026.4.5 on a different scheme. Treat the current checkout as affected.
- **piflow, Langchain-Chatchat, Aix-DB, JoySafeter, MoviePilot.** The record's upper bound is the newest version; nothing referenced says otherwise.

One identifier note. The Lasso page for Cognition lives at the URL slug `cve-2026-74232` but prints CVE-2026-109437, and a search-engine snapshot of the index still showed Cognition as CVE-2026-74232. On CVE Services, CVE-2026-74232 is a VulnCheck record published 2026-08-27 for a Zbtlink router implant. The ids in the table above come from CVE Services, not from the slug.

## Am I affected?

- You self-host any product in the table at a version inside its range. For DB-GPT, Letta, Langchain-Chatchat, piflow, Aix-DB, JoySafeter, OpenSRE, LangAlpha and MoviePilot that is every version, including the newest.
- The unauthenticated records (DB-GPT, Letta, Langchain-Chatchat, piflow, Cognition before 0.13.0) matter the moment the service is reachable from a network you do not control. Check what the host binds to and whether a reverse proxy adds authentication.
- The prompt-injection records (EvoScientist, OpenSRE, LangAlpha) matter when the agent reads anything an outsider can write: web pages, alerts, Slack messages, tickets, documents.
- You built your own app on Deep Agents with `execute` or a shell backend and did not set `interrupt_on` for it, or you wrote a presenter whose `execution_allowed()` returns true. The records describe exactly that app.
- For Deep Agents, also read [the framework's own October advisories](2026-10-deepagents-filesystem-rule-alternate-path-bypass-acp-always-allow-shell-bypass-ghsa-pair.md): path rules and "Always allow" grants were bypassable in the framework before 0.7.25 and 0.0.13.

## If you are affected

1. Take the service off routable networks or put an authenticating reverse proxy in front of it today. None of the nine unfixed products has a vendor statement to wait for.
2. Upgrade Cognition to v0.13.0 or later and keep the unsafe local-execution flag off, EvoScientist to v0.2.5 or later, and Coze Studio past the CVE-2026-77934 fix commit.
3. Treat every credential in the service's environment as reachable by a prompt: LLM provider keys, database URLs, Slack and cloud tokens, the `.vault_secrets` style stores the records name. Rotate them if the service was reachable, following [rotating cloud credentials](../playbooks/rotating-cloud-credentials.md).
4. Where the framework supports it, put a human approval step on every tool that runs commands, writes files or moves money, and make the approval decision at the executor, not in the prompt.
5. Run the agent process in a container or VM with no credentials it does not need, per [agent sandboxing](../prevention/agent-sandboxing.md). The LangAlpha record is a reminder that tenants sharing one Docker bridge are not isolated from each other.
6. If the host was reachable and ran one of the unauthenticated products, follow [if your local AI agent was exploited](../playbooks/if-your-local-ai-agent-was-exploited.md).

## Prevention

- [Agent sandboxing](../prevention/agent-sandboxing.md): an OS boundary under any agent that can run commands.
- [Credential hygiene](../prevention/credential-hygiene.md): the environment the agent runs in is the credential set a prompt can reach.
- [MCP hygiene](../prevention/mcp-hygiene.md): the same gate question for tools reached over MCP.

## Sources
- [CVE Services — CVE-2026-77932](https://cveawg.mitre.org/api/cve/CVE-2026-77932), [CVE-2026-77933](https://cveawg.mitre.org/api/cve/CVE-2026-77933), [CVE-2026-77936](https://cveawg.mitre.org/api/cve/CVE-2026-77936), [CVE-2026-77937](https://cveawg.mitre.org/api/cve/CVE-2026-77937), [CVE-2026-77938](https://cveawg.mitre.org/api/cve/CVE-2026-77938), [CVE-2026-75128](https://cveawg.mitre.org/api/cve/CVE-2026-75128), [CVE-2026-109442](https://cveawg.mitre.org/api/cve/CVE-2026-109442), [CVE-2026-109437](https://cveawg.mitre.org/api/cve/CVE-2026-109437), [CVE-2026-77930](https://cveawg.mitre.org/api/cve/CVE-2026-77930), [CVE-2026-109444](https://cveawg.mitre.org/api/cve/CVE-2026-109444), [CVE-2026-109440](https://cveawg.mitre.org/api/cve/CVE-2026-109440), [CVE-2026-109441](https://cveawg.mitre.org/api/cve/CVE-2026-109441), [CVE-2026-77926](https://cveawg.mitre.org/api/cve/CVE-2026-77926), [CVE-2026-109443](https://cveawg.mitre.org/api/cve/CVE-2026-109443), [CVE-2026-77934](https://cveawg.mitre.org/api/cve/CVE-2026-77934), [CVE-2026-77935](https://cveawg.mitre.org/api/cve/CVE-2026-77935), [CVE-2026-77931](https://cveawg.mitre.org/api/cve/CVE-2026-77931) — all fetched 2026-10-20: VulnCheck CNA, the titles, ranges, scores and references in the table. [CVE-2026-74232](https://cveawg.mitre.org/api/cve/CVE-2026-74232) fetched the same day for the identifier note (Zbtlink, 2026-08-27); CVE-2026-97693 returned `CVE_RECORD_DNE`.
- [VulnCheck — DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent](https://www.vulncheck.com/advisories/db-gpt-through-0.8.2-unauthenticated-rce-via-api-v1-chat-react-agent) and [Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header](https://www.vulncheck.com/advisories/letta-through-0.16.8-cross-tenant-impersonation-via-user-id-header) — fetched 2026-10-20: reporters Noy Pearl, Michael Sromin, Ophir Dror; date 2026-10-19 on both pages; no fix status.
- [Lasso Security — vulnerability database index](https://www.lasso.security/vulnerability-database) — fetched 2026-10-20: the 21 entries, their labels, scores and page dates (2026-08-24 to 2026-10-18). [Lasso — CVE-2026-77932](https://www.lasso.security/vulnerability-database/cve-2026-77932) (tested commit 100acd7, v0.8.1; no fix named; reporter not named) and [the page at slug cve-2026-74232](https://www.lasso.security/vulnerability-database/cve-2026-74232), which prints CVE-2026-109437 and says the issue is addressed in Cognition v0.13.0.
- [GitHub Advisory Database — "agent", sorted by published date](https://github.com/advisories?query=agent+sort%3Apublished-desc) and [the "llm" listing](https://github.com/advisories?query=llm+sort%3Apublished-desc) — fetched 2026-10-20: the ten records on page 1 dated 10-19 and 10-20 that opened this file.
- [CognicellAI/Cognition — release v0.13.0](https://github.com/CognicellAI/Cognition/releases/tag/v0.13.0) — fetched 2026-10-20: the 2026-07-27 changelog lines on fail-closed production execution; no CVE named. [EvoScientist — release v0.2.5](https://github.com/EvoScientist/EvoScientist/releases/tag/v0.2.5) — fetched 2026-10-20: approval policy covering sync and async sub-agents, the backend guard, `shell_allow_list` per-segment checks.
- [letta-ai/letta — releases](https://github.com/letta-ai/letta/releases) (v0.16.8 newest, 0.16.x scheme, no authentication note) and [security advisories tab](https://github.com/letta-ai/letta/security/advisories) (none); [coze-dev/coze-studio — security advisories tab](https://github.com/coze-dev/coze-studio/security/advisories) (none) — fetched 2026-10-20.
- PyPI JSON for `dbgpt` (0.8.2, 2026-08-26), `letta` (0.34.12, 2026-10-12), `evoscientist` (0.3.7) and `opensre` (2026.4.5) — read 2026-10-20 for the version notes.
- Related in this corpus: [the Ro1ME wave](2026-09-ro1me-open-source-agent-framework-llm-output-execution-cve-wave.md) (DB-GPT CVE-2026-51866, Langchain-Chatchat ids), [the VulnCheck single-researcher wave](2026-10-vulncheck-single-researcher-agent-mcp-gateway-cve-wave-mini-swe-agent-env-leak.md) (Astron Agent), [IntentKit CVE-2026-76066](2026-10-intentkit-executor-owner-only-tool-authorization-bypass-cve-2026-76066.md), [the Deep Agents advisories](2026-10-deepagents-filesystem-rule-alternate-path-bypass-acp-always-allow-shell-bypass-ghsa-pair.md).