https://blog.lynxflow.co/en/tags/open-source-security/Recent content in Open Source Security on Lynx Tech BlogHugo -- gohugo.ioenFri, 28 Aug 2026 00:00:00 +0800https://blog.lynxflow.co/en/posts/first-accepted-security-advisory-qwed-mcp-rce/Fri, 28 Aug 2026 00:00:00 +0800https://blog.lynxflow.co/en/posts/first-accepted-security-advisory-qwed-mcp-rce/On the afternoon of August 27, 2026, I refreshed a private advisory page and watched its status flip from triage to published. That was a genuinely good moment. An advisory in four and a half hours The advisory is GHSA-2p69-jpm6-jrxh, severity Critical, CVSS 9.8. Its title reads: qwed-mcp: RCE bypass of CVE-2026-55546 fix via __getattribute__ and string concatenation In plain terms: qwed-mcp had just patched a remote-code-execution CVE (CVE-2026-55546) in its 0.2.1 release by adding a denylist o