Tag

by-design-vulnerability

Safeguard articles tagged "by-design-vulnerability" — guides, analysis, and best practices for software supply chain and application security.

1 article

Supply Chain Attacks

When the Vulnerability Is the Design: MCP STDIO Command Injection Across 150M Downloads (May 2026)

OX Security documented command injection through the MCP STDIO transport across Python, TypeScript, Java, and Rust SDKs. Anthropic calls the behavior by-design and won't patch upstream. That leaves the fix to thousands of downstream projects.

May 6, 202611 min read