{"action":"Upgrade atomic-agents-stack to 1.1.0 or later.","affected":[{"fixed":"1.1.0","introduced":"0"}],"component":"atomic-agents-stack","cve_ids":["CVE-2026-91988"],"ecosystem":"PyPI","epss":0.00318,"exploited":false,"fixed_versions":["1.1.0"],"ghsa_id":"GHSA-xhcr-cqfr-m3hv","id":"tcs_01M5KG48HHB7XWRTG8DPXFTX09","modified_at":"2026-09-16T03:56:06.204188287Z","published_at":"2026-08-17T21:49:55Z","references":["https://osv.dev/vulnerability/GHSA-xhcr-cqfr-m3hv","https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-xhcr-cqfr-m3hv","https://github.com/dep0we/atomic-agents-stack","https://github.com/dep0we/atomic-agents-stack/releases#release-v1.1.0"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-xhcr-cqfr-m3hv","url":"https://osv.dev/vulnerability/GHSA-xhcr-cqfr-m3hv"}],"summary":"atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)"}