{"action":"Upgrade atomic-agents-stack to 1.1.0 or later.","affected":[{"fixed":"1.1.0","introduced":"0"}],"component":"atomic-agents-stack","cve_ids":["CVE-2026-91987"],"ecosystem":"PyPI","epss":0.00476,"exploited":false,"fixed_versions":["1.1.0"],"ghsa_id":"GHSA-j659-8xh6-5pq5","id":"tcs_01M5KFN782N3V4NFBKB7D3ZF9T","modified_at":"2026-09-16T03:56:06.072717965Z","published_at":"2026-08-17T21:50:01Z","references":["https://osv.dev/vulnerability/GHSA-j659-8xh6-5pq5","https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-j659-8xh6-5pq5","https://github.com/dep0we/atomic-agents-stack","https://github.com/dep0we/atomic-agents-stack/releases#release-v1.1.0"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-j659-8xh6-5pq5","url":"https://osv.dev/vulnerability/GHSA-j659-8xh6-5pq5"}],"summary":"atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard"}