Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities found for beam_mcp by ScriptKittyOS
CVE-2026-88257 (GCVE-0-2026-88257)
Vulnerability from nvd – Published: 2026-10-08 13:40 – Updated: 2026-10-08 14:09
VLAI
EPSS
VEX
Title
beam_mcp: nested tool argument constraints advertised but not enforced
Summary
Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (items, minItems, maxItems, minLength, maxLength, pattern, nested required, enum and additionalProperties: false) were advertised by tools/list and never checked at tools/call or prompts/get, and keywords outside the enforced subset (oneOf, anyOf, $ref) were advertised and ignored.
A host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.
This issue affects beam_mcp: from 0.1.0 before 0.10.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 13:59 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ScriptKittyOS/beam_mcp/securit… | relatedvendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-88257.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-88257 | related |
| https://github.com/ScriptKittyOS/beam_mcp/commit/… | related |
| https://github.com/ScriptKittyOS/beam_mcp/commit/… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ScriptKittyOS | beam_mcp |
Affected:
0.1.0 , < 0.10.1
(semver)
cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:* |
|
| ScriptKittyOS | beam_mcp |
Affected:
083838eb8e17fe5f6fcaf761bdbe203110288b0b , < 289dbdbad641943b29a3b8d1eb36506cc8cec10a
(git)
cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:* |
Date Public
2026-09-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88257",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T13:59:14.866448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:59:33.374Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.BeamMCP.Schema\u0027",
"\u0027Elixir.BeamMCP.Server\u0027"
],
"packageName": "beam_mcp",
"packageURL": "pkg:hex/beam_mcp",
"product": "beam_mcp",
"programFiles": [
"lib/beam_mcp/schema.ex",
"lib/beam_mcp/server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.BeamMCP.Schema\u0027:validate/2"
},
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
}
],
"repo": "https://github.com/ScriptKittyOS/beam_mcp",
"vendor": "ScriptKittyOS",
"versions": [
{
"lessThan": "0.10.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.BeamMCP.Schema\u0027",
"\u0027Elixir.BeamMCP.Server\u0027"
],
"packageName": "scriptkittyos/beam_mcp",
"packageURL": "pkg:github/scriptkittyos/beam_mcp",
"product": "beam_mcp",
"programFiles": [
"lib/beam_mcp/schema.ex",
"lib/beam_mcp/server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.BeamMCP.Schema\u0027:validate/2"
},
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
}
],
"repo": "https://github.com/ScriptKittyOS/beam_mcp",
"vendor": "ScriptKittyOS",
"versions": [
{
"lessThan": "289dbdbad641943b29a3b8d1eb36506cc8cec10a",
"status": "affected",
"version": "083838eb8e17fe5f6fcaf761bdbe203110288b0b",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.10.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ayla Croft / Script Kitty OS"
},
{
"lang": "en",
"type": "reporter",
"value": "Ayla Croft / Script Kitty OS"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ayla Croft / Script Kitty OS"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-08T13:40:44.000Z",
"datePublic": "2026-09-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Input Validation vulnerability in \u003ccode\u003eBeamMCP.Schema\u003c/code\u003e in ScriptKittyOS beam_mcp allows an MCP client to reach a tool\u0027s dispatch function with arguments that violate the input schema the server advertised. \u003ccode\u003eBeamMCP.Schema.validate/2\u003c/code\u003e checked \u003ccode\u003etype\u003c/code\u003e, \u003ccode\u003erequired\u003c/code\u003e, \u003ccode\u003eadditionalProperties\u003c/code\u003e, \u003ccode\u003eenum\u003c/code\u003e and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (\u003ccode\u003eitems\u003c/code\u003e, \u003ccode\u003eminItems\u003c/code\u003e, \u003ccode\u003emaxItems\u003c/code\u003e, \u003ccode\u003eminLength\u003c/code\u003e, \u003ccode\u003emaxLength\u003c/code\u003e, \u003ccode\u003epattern\u003c/code\u003e, nested \u003ccode\u003erequired\u003c/code\u003e, \u003ccode\u003eenum\u003c/code\u003e and \u003ccode\u003eadditionalProperties: false\u003c/code\u003e) were advertised by \u003ccode\u003etools/list\u003c/code\u003e and never checked at \u003ccode\u003etools/call\u003c/code\u003e or \u003ccode\u003eprompts/get\u003c/code\u003e, and keywords outside the enforced subset (\u003ccode\u003eoneOf\u003c/code\u003e, \u003ccode\u003eanyOf\u003c/code\u003e, \u003ccode\u003e$ref\u003c/code\u003e) were advertised and ignored.\u003c/p\u003e\n\u003cp\u003eA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.\u003c/p\u003e\n\u003cp\u003eThis issue affects beam_mcp: from 0.1.0 before 0.10.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Input Validation vulnerability in `BeamMCP.Schema` in ScriptKittyOS beam_mcp allows an MCP client to reach a tool\u0027s dispatch function with arguments that violate the input schema the server advertised. `BeamMCP.Schema.validate/2` checked `type`, `required`, `additionalProperties`, `enum` and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (`items`, `minItems`, `maxItems`, `minLength`, `maxLength`, `pattern`, nested `required`, `enum` and `additionalProperties: false`) were advertised by `tools/list` and never checked at `tools/call` or `prompts/get`, and keywords outside the enforced subset (`oneOf`, `anyOf`, `$ref`) were advertised and ignored.\n\nA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.\n\nThis issue affects beam_mcp: from 0.1.0 before 0.10.1."
}
],
"value": "Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool\u0027s dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (items, minItems, maxItems, minLength, maxLength, pattern, nested required, enum and additionalProperties: false) were advertised by tools/list and never checked at tools/call or prompts/get, and keywords outside the enforced subset (oneOf, anyOf, $ref) were advertised and ignored.\n\nA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.\n\nThis issue affects beam_mcp: from 0.1.0 before 0.10.1."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn MCP client can hand a host\u0027s tool values the host\u0027s declared schema forbids, such as an out-of-range number or an undeclared key inside a nested object. The consequence depends on what the host\u0027s dispatch code does with a value it never expected to receive.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An MCP client can hand a host\u0027s tool values the host\u0027s declared schema forbids, such as an out-of-range number or an undeclared key inside a nested object. The consequence depends on what the host\u0027s dispatch code does with a value it never expected to receive."
}
],
"value": "An MCP client can hand a host\u0027s tool values the host\u0027s declared schema forbids, such as an out-of-range number or an undeclared key inside a nested object. The consequence depends on what the host\u0027s dispatch code does with a value it never expected to receive."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:09:41.540Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GitHub Advisory",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/ScriptKittyOS/beam_mcp/security/advisories/GHSA-mrg2-4747-fmpw"
},
{
"name": "EEF CNA record for CVE-2026-88257",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-88257.html"
},
{
"name": "OSV record EEF-CVE-2026-88257",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-88257"
},
{
"name": "Introducing commit 083838e in ScriptKittyOS/beam_mcp",
"tags": [
"related"
],
"url": "https://github.com/ScriptKittyOS/beam_mcp/commit/083838eb8e17fe5f6fcaf761bdbe203110288b0b"
},
{
"name": "Fix commit 289dbdb in ScriptKittyOS/beam_mcp",
"tags": [
"patch"
],
"url": "https://github.com/ScriptKittyOS/beam_mcp/commit/289dbdbad641943b29a3b8d1eb36506cc8cec10a"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "beam_mcp: nested tool argument constraints advertised but not enforced",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRe-validate the arguments inside the host\u0027s dispatch function against every constraint the schema declares below the top level, or move each constraint to a top-level property, which the affected versions do enforce.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Re-validate the arguments inside the host\u0027s dispatch function against every constraint the schema declares below the top level, or move each constraint to a top-level property, which the affected versions do enforce."
}
],
"value": "Re-validate the arguments inside the host\u0027s dispatch function against every constraint the schema declares below the top level, or move each constraint to a top-level property, which the affected versions do enforce."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eDeclare a tool whose \u003ccode\u003einput_schema\u003c/code\u003e has a nested object property \u003ccode\u003eopts\u003c/code\u003e with \u003ccode\u003e\"properties\": {\"level\": {\"type\": \"integer\", \"maximum\": 3}}\u003c/code\u003e, \u003ccode\u003e\"required\": [\"level\"]\u003c/code\u003e and \u003ccode\u003e\"additionalProperties\": false\u003c/code\u003e, and an array property \u003ccode\u003etags\u003c/code\u003e with \u003ccode\u003e\"items\": {\"type\": \"string\"}\u003c/code\u003e and \u003ccode\u003e\"maxItems\": 2\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003etools/call\u003c/code\u003e with \u003ccode\u003e\"arguments\": {\"opts\": {\"level\": 99, \"extra\": \"x\"}}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOn beam_mcp 0.10.0 the dispatch function receives \u003ccode\u003e%{opts: %{\"extra\" =\u0026gt; \"x\", \"level\" =\u0026gt; 99}}\u003c/code\u003e. On 0.10.1 the call is refused with \u003ccode\u003einvalid arguments: unknown property: opts.extra\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003e\"arguments\": {\"tags\": [1, 2, 3]}\u003c/code\u003e. On 0.10.0 the dispatch function receives \u003ccode\u003etags: [1, 2, 3]\u003c/code\u003e. On 0.10.1 the call is refused with \u003ccode\u003etags must have at most 2 items\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Declare a tool whose `input_schema` has a nested object property `opts` with `\"properties\": {\"level\": {\"type\": \"integer\", \"maximum\": 3}}`, `\"required\": [\"level\"]` and `\"additionalProperties\": false`, and an array property `tags` with `\"items\": {\"type\": \"string\"}` and `\"maxItems\": 2`.\n2. Send `tools/call` with `\"arguments\": {\"opts\": {\"level\": 99, \"extra\": \"x\"}}`.\n3. On beam_mcp 0.10.0 the dispatch function receives `%{opts: %{\"extra\" =\u003e \"x\", \"level\" =\u003e 99}}`. On 0.10.1 the call is refused with `invalid arguments: unknown property: opts.extra`.\n4. Send `\"arguments\": {\"tags\": [1, 2, 3]}`. On 0.10.0 the dispatch function receives `tags: [1, 2, 3]`. On 0.10.1 the call is refused with `tags must have at most 2 items`."
}
],
"value": "* Declare a tool whose input_schema has a nested object property opts with \"properties\": {\"level\": {\"type\": \"integer\", \"maximum\": 3}}, \"required\": [\"level\"] and \"additionalProperties\": false, and an array property tags with \"items\": {\"type\": \"string\"} and \"maxItems\": 2.\n* Send tools/call with \"arguments\": {\"opts\": {\"level\": 99, \"extra\": \"x\"}}.\n* On beam_mcp 0.10.0 the dispatch function receives %{opts: %{\"extra\" =\u003e \"x\", \"level\" =\u003e 99}}. On 0.10.1 the call is refused with invalid arguments: unknown property: opts.extra.\n* Send \"arguments\": {\"tags\": [1, 2, 3]}. On 0.10.0 the dispatch function receives tags: [1, 2, 3]. On 0.10.1 the call is refused with tags must have at most 2 items."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Advertising.\u003c/strong\u003e \u003ccode\u003etools/list\u003c/code\u003e returns each tool\u0027s \u003ccode\u003einput_schema\u003c/code\u003e verbatim, including nested \u003ccode\u003eproperties\u003c/code\u003e, \u003ccode\u003eitems\u003c/code\u003e and constraint keywords.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Validation.\u003c/strong\u003e \u003ccode\u003eBeamMCP.Schema.validate/2\u003c/code\u003e in \u003ccode\u003elib/beam_mcp/schema.ex\u003c/code\u003e walks only the first level: \u003ccode\u003echeck_required/2\u003c/code\u003e and \u003ccode\u003echeck_additional/3\u003c/code\u003e run on the top-level object, and \u003ccode\u003echeck_properties/2\u003c/code\u003e applies \u003ccode\u003echeck_type\u003c/code\u003e, \u003ccode\u003echeck_enum\u003c/code\u003e and \u003ccode\u003echeck_range\u003c/code\u003e to each top-level value. A value of type \u003ccode\u003eobject\u003c/code\u003e or \u003ccode\u003earray\u003c/code\u003e is accepted once its own type matches, and its contents are not visited. Keywords the validator does not know are ignored.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Dispatch.\u003c/strong\u003e \u003ccode\u003eBeamMCP.Server.validate_and_dispatch/3\u003c/code\u003e passes the accepted arguments to \u003ccode\u003enormalize_arguments/2\u003c/code\u003e and then to the host\u0027s dispatch function, so an undeclared key inside a nested object, an out-of-range nested number, or an array item of the wrong type reaches host code that believed the schema excluded it. The same validator runs on \u003ccode\u003eprompts/get\u003c/code\u003e arguments. The fix in 0.10.1 enforces every keyword of the documented subset at every depth and refuses a schema that uses any other keyword when the catalog is loaded.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Advertising.** `tools/list` returns each tool\u0027s `input_schema` verbatim, including nested `properties`, `items` and constraint keywords.\n\n**2. Validation.** `BeamMCP.Schema.validate/2` in `lib/beam_mcp/schema.ex` walks only the first level: `check_required/2` and `check_additional/3` run on the top-level object, and `check_properties/2` applies `check_type`, `check_enum` and `check_range` to each top-level value. A value of type `object` or `array` is accepted once its own type matches, and its contents are not visited. Keywords the validator does not know are ignored.\n\n**3. Dispatch.** `BeamMCP.Server.validate_and_dispatch/3` passes the accepted arguments to `normalize_arguments/2` and then to the host\u0027s dispatch function, so an undeclared key inside a nested object, an out-of-range nested number, or an array item of the wrong type reaches host code that believed the schema excluded it. The same validator runs on `prompts/get` arguments. The fix in 0.10.1 enforces every keyword of the documented subset at every depth and refuses a schema that uses any other keyword when the catalog is loaded."
}
],
"value": "1. Advertising. tools/list returns each tool\u0027s input_schema verbatim, including nested properties, items and constraint keywords.\n\n2. Validation. BeamMCP.Schema.validate/2 in lib/beam_mcp/schema.ex walks only the first level: check_required/2 and check_additional/3 run on the top-level object, and check_properties/2 applies check_type, check_enum and check_range to each top-level value. A value of type object or array is accepted once its own type matches, and its contents are not visited. Keywords the validator does not know are ignored.\n\n3. Dispatch. BeamMCP.Server.validate_and_dispatch/3 passes the accepted arguments to normalize_arguments/2 and then to the host\u0027s dispatch function, so an undeclared key inside a nested object, an out-of-range nested number, or an array item of the wrong type reaches host code that believed the schema excluded it. The same validator runs on prompts/get arguments. The fix in 0.10.1 enforces every keyword of the documented subset at every depth and refuses a schema that uses any other keyword when the catalog is loaded."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-88257",
"datePublished": "2026-10-08T13:40:55.828Z",
"dateReserved": "2026-10-07T22:15:01.878Z",
"dateUpdated": "2026-10-08T14:09:41.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104634 (GCVE-0-2026-104634)
Vulnerability from nvd – Published: 2026-10-08 13:41 – Updated: 2026-10-08 13:58
VLAI
EPSS
VEX
Title
beam_mcp: JSON boolean and null tool arguments reach dispatch as strings
Summary
Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null tool arguments to reach the host's dispatch function as the strings "true", "false" and "nil". After BeamMCP.Schema.validate/2 accepted a value as a boolean, normalize_arguments/2 passed every argument through to_json_value/1, whose atom clause converts true, false and nil to strings. A string is truthy in Elixir, so a host that tests a boolean argument, for example if args.dry_run, takes the opposite branch for false, and a guard such as confirm: false reads as set.
The client controls the argument and could send true directly, so the practical impact is limited to hosts whose behaviour on false differs from their behaviour on true, and to any policy layer in front of the server that permits false but refuses true. The same normalisation applies to prompts/get arguments, which exist from 0.5.0.
This issue affects beam_mcp: from 0.1.0 before 0.10.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 13:58 UTC
CWE
- CWE-704 - Incorrect Type Conversion or Cast
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ScriptKittyOS/beam_mcp/securit… | relatedvendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-104634.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-104634 | related |
| https://github.com/ScriptKittyOS/beam_mcp/commit/… | related |
| https://github.com/ScriptKittyOS/beam_mcp/commit/… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ScriptKittyOS | beam_mcp |
Affected:
0.1.0 , < 0.10.1
(semver)
cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:* |
|
| ScriptKittyOS | beam_mcp |
Affected:
083838eb8e17fe5f6fcaf761bdbe203110288b0b , < 289dbdbad641943b29a3b8d1eb36506cc8cec10a
(git)
cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:* |
Date Public
2026-09-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104634",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T13:58:26.222349Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:58:34.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.BeamMCP.Server\u0027"
],
"packageName": "beam_mcp",
"packageURL": "pkg:hex/beam_mcp",
"product": "beam_mcp",
"programFiles": [
"lib/beam_mcp/server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
},
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:normalize_arguments/2"
},
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:to_json_value/1"
}
],
"repo": "https://github.com/ScriptKittyOS/beam_mcp",
"vendor": "ScriptKittyOS",
"versions": [
{
"lessThan": "0.10.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.BeamMCP.Server\u0027"
],
"packageName": "scriptkittyos/beam_mcp",
"packageURL": "pkg:github/scriptkittyos/beam_mcp",
"product": "beam_mcp",
"programFiles": [
"lib/beam_mcp/server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
},
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:normalize_arguments/2"
},
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:to_json_value/1"
}
],
"repo": "https://github.com/ScriptKittyOS/beam_mcp",
"vendor": "ScriptKittyOS",
"versions": [
{
"lessThan": "289dbdbad641943b29a3b8d1eb36506cc8cec10a",
"status": "affected",
"version": "083838eb8e17fe5f6fcaf761bdbe203110288b0b",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.10.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ayla Croft / Script Kitty OS"
},
{
"lang": "en",
"type": "reporter",
"value": "Ayla Croft / Script Kitty OS"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ayla Croft / Script Kitty OS"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-08T13:40:59.000Z",
"datePublic": "2026-09-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Type Conversion or Cast vulnerability in \u003ccode\u003eBeamMCP.Server\u003c/code\u003e in ScriptKittyOS beam_mcp allows an MCP client\u0027s JSON \u003ccode\u003etrue\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e and \u003ccode\u003enull\u003c/code\u003e tool arguments to reach the host\u0027s dispatch function as the strings \"true\", \"false\" and \"nil\". After \u003ccode\u003eBeamMCP.Schema.validate/2\u003c/code\u003e accepted a value as a boolean, \u003ccode\u003enormalize_arguments/2\u003c/code\u003e passed every argument through \u003ccode\u003eto_json_value/1\u003c/code\u003e, whose atom clause converts \u003ccode\u003etrue\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e and \u003ccode\u003enil\u003c/code\u003e to strings. A string is truthy in Elixir, so a host that tests a boolean argument, for example \u003ccode\u003eif args.dry_run\u003c/code\u003e, takes the opposite branch for \u003ccode\u003efalse\u003c/code\u003e, and a guard such as \u003ccode\u003econfirm: false\u003c/code\u003e reads as set.\u003c/p\u003e\n\u003cp\u003eThe client controls the argument and could send \u003ccode\u003etrue\u003c/code\u003e directly, so the practical impact is limited to hosts whose behaviour on \u003ccode\u003efalse\u003c/code\u003e differs from their behaviour on \u003ccode\u003etrue\u003c/code\u003e, and to any policy layer in front of the server that permits \u003ccode\u003efalse\u003c/code\u003e but refuses \u003ccode\u003etrue\u003c/code\u003e. The same normalisation applies to \u003ccode\u003eprompts/get\u003c/code\u003e arguments, which exist from 0.5.0.\u003c/p\u003e\n\u003cp\u003eThis issue affects beam_mcp: from 0.1.0 before 0.10.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Type Conversion or Cast vulnerability in `BeamMCP.Server` in ScriptKittyOS beam_mcp allows an MCP client\u0027s JSON `true`, `false` and `null` tool arguments to reach the host\u0027s dispatch function as the strings \"true\", \"false\" and \"nil\". After `BeamMCP.Schema.validate/2` accepted a value as a boolean, `normalize_arguments/2` passed every argument through `to_json_value/1`, whose atom clause converts `true`, `false` and `nil` to strings. A string is truthy in Elixir, so a host that tests a boolean argument, for example `if args.dry_run`, takes the opposite branch for `false`, and a guard such as `confirm: false` reads as set.\n\nThe client controls the argument and could send `true` directly, so the practical impact is limited to hosts whose behaviour on `false` differs from their behaviour on `true`, and to any policy layer in front of the server that permits `false` but refuses `true`. The same normalisation applies to `prompts/get` arguments, which exist from 0.5.0.\n\nThis issue affects beam_mcp: from 0.1.0 before 0.10.1."
}
],
"value": "Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client\u0027s JSON true, false and null tool arguments to reach the host\u0027s dispatch function as the strings \"true\", \"false\" and \"nil\". After BeamMCP.Schema.validate/2 accepted a value as a boolean, normalize_arguments/2 passed every argument through to_json_value/1, whose atom clause converts true, false and nil to strings. A string is truthy in Elixir, so a host that tests a boolean argument, for example if args.dry_run, takes the opposite branch for false, and a guard such as confirm: false reads as set.\n\nThe client controls the argument and could send true directly, so the practical impact is limited to hosts whose behaviour on false differs from their behaviour on true, and to any policy layer in front of the server that permits false but refuses true. The same normalisation applies to prompts/get arguments, which exist from 0.5.0.\n\nThis issue affects beam_mcp: from 0.1.0 before 0.10.1."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA host that branches on a boolean argument takes the opposite branch for \u003ccode\u003efalse\u003c/code\u003e, so a safety guard such as \u003ccode\u003econfirm: false\u003c/code\u003e or \u003ccode\u003edry_run: false\u003c/code\u003e is read as set. The client already controls the argument, so the gain over sending \u003ccode\u003etrue\u003c/code\u003e is limited to hosts and intermediaries that treat the two values differently.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A host that branches on a boolean argument takes the opposite branch for `false`, so a safety guard such as `confirm: false` or `dry_run: false` is read as set. The client already controls the argument, so the gain over sending `true` is limited to hosts and intermediaries that treat the two values differently."
}
],
"value": "A host that branches on a boolean argument takes the opposite branch for false, so a safety guard such as confirm: false or dry_run: false is read as set. The client already controls the argument, so the gain over sending true is limited to hosts and intermediaries that treat the two values differently."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-704",
"description": "CWE-704 Incorrect Type Conversion or Cast",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:41:05.745Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GitHub Advisory",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/ScriptKittyOS/beam_mcp/security/advisories/GHSA-wv7p-j6qh-3hj4"
},
{
"name": "EEF CNA record for CVE-2026-104634",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-104634.html"
},
{
"name": "OSV record EEF-CVE-2026-104634",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-104634"
},
{
"name": "Introducing commit 083838e in ScriptKittyOS/beam_mcp",
"tags": [
"related"
],
"url": "https://github.com/ScriptKittyOS/beam_mcp/commit/083838eb8e17fe5f6fcaf761bdbe203110288b0b"
},
{
"name": "Fix commit 289dbdb in ScriptKittyOS/beam_mcp",
"tags": [
"patch"
],
"url": "https://github.com/ScriptKittyOS/beam_mcp/commit/289dbdbad641943b29a3b8d1eb36506cc8cec10a"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "beam_mcp: JSON boolean and null tool arguments reach dispatch as strings",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn the host\u0027s dispatch function, compare boolean arguments against both forms, for example \u003ccode\u003eargs.flag in [true, \"true\"]\u003c/code\u003e and \u003ccode\u003eargs.flag in [false, \"false\"]\u003c/code\u003e, and treat the string \"nil\" as \u003ccode\u003enull\u003c/code\u003e where the schema admits null.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "In the host\u0027s dispatch function, compare boolean arguments against both forms, for example `args.flag in [true, \"true\"]` and `args.flag in [false, \"false\"]`, and treat the string \"nil\" as `null` where the schema admits null."
}
],
"value": "In the host\u0027s dispatch function, compare boolean arguments against both forms, for example args.flag in [true, \"true\"] and args.flag in [false, \"false\"], and treat the string \"nil\" as null where the schema admits null."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eDeclare a tool whose \u003ccode\u003einput_schema\u003c/code\u003e has \u003ccode\u003e\"dry_run\": {\"type\": \"boolean\"}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003etools/call\u003c/code\u003e with \u003ccode\u003e\"arguments\": {\"dry_run\": false}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOn beam_mcp 0.10.0 the dispatch function receives \u003ccode\u003e%{dry_run: \"false\"}\u003c/code\u003e and \u003ccode\u003eif args.dry_run\u003c/code\u003e evaluates the true branch. On 0.10.1 it receives \u003ccode\u003e%{dry_run: false}\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Declare a tool whose `input_schema` has `\"dry_run\": {\"type\": \"boolean\"}`.\n2. Send `tools/call` with `\"arguments\": {\"dry_run\": false}`.\n3. On beam_mcp 0.10.0 the dispatch function receives `%{dry_run: \"false\"}` and `if args.dry_run` evaluates the true branch. On 0.10.1 it receives `%{dry_run: false}`."
}
],
"value": "* Declare a tool whose input_schema has \"dry_run\": {\"type\": \"boolean\"}.\n* Send tools/call with \"arguments\": {\"dry_run\": false}.\n* On beam_mcp 0.10.0 the dispatch function receives %{dry_run: \"false\"} and if args.dry_run evaluates the true branch. On 0.10.1 it receives %{dry_run: false}."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Validation.\u003c/strong\u003e \u003ccode\u003eBeamMCP.Schema.check_type/3\u003c/code\u003e accepts a JSON \u003ccode\u003efalse\u003c/code\u003e for a \u003ccode\u003eboolean\u003c/code\u003e property because the decoded value is the atom \u003ccode\u003efalse\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Normalisation.\u003c/strong\u003e \u003ccode\u003eBeamMCP.Server.normalize_arguments/2\u003c/code\u003e in \u003ccode\u003elib/beam_mcp/server.ex\u003c/code\u003e maps each declared key to an atom and passes each value through \u003ccode\u003eto_json_value/1\u003c/code\u003e. That function was written to encode host results for the wire, and its clause \u003ccode\u003ewhen is_atom(value)\u003c/code\u003e converts the value with \u003ccode\u003eAtom.to_string/1\u003c/code\u003e. \u003ccode\u003etrue\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e and \u003ccode\u003enil\u003c/code\u003e are atoms, so they become the strings \"true\", \"false\" and \"nil\", at any depth of the argument map.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Dispatch.\u003c/strong\u003e The host receives \u003ccode\u003e%{dry_run: \"false\"}\u003c/code\u003e. Any string is truthy in Elixir, so \u003ccode\u003eif args.dry_run\u003c/code\u003e takes the true branch. A host result carrying booleans was stringified the same way on the way out. The fix in 0.10.1 adds a clause that passes booleans and \u003ccode\u003enil\u003c/code\u003e through unchanged.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Validation.** `BeamMCP.Schema.check_type/3` accepts a JSON `false` for a `boolean` property because the decoded value is the atom `false`.\n\n**2. Normalisation.** `BeamMCP.Server.normalize_arguments/2` in `lib/beam_mcp/server.ex` maps each declared key to an atom and passes each value through `to_json_value/1`. That function was written to encode host results for the wire, and its clause `when is_atom(value)` converts the value with `Atom.to_string/1`. `true`, `false` and `nil` are atoms, so they become the strings \"true\", \"false\" and \"nil\", at any depth of the argument map.\n\n**3. Dispatch.** The host receives `%{dry_run: \"false\"}`. Any string is truthy in Elixir, so `if args.dry_run` takes the true branch. A host result carrying booleans was stringified the same way on the way out. The fix in 0.10.1 adds a clause that passes booleans and `nil` through unchanged."
}
],
"value": "1. Validation. BeamMCP.Schema.check_type/3 accepts a JSON false for a boolean property because the decoded value is the atom false.\n\n2. Normalisation. BeamMCP.Server.normalize_arguments/2 in lib/beam_mcp/server.ex maps each declared key to an atom and passes each value through to_json_value/1. That function was written to encode host results for the wire, and its clause when is_atom(value) converts the value with Atom.to_string/1. true, false and nil are atoms, so they become the strings \"true\", \"false\" and \"nil\", at any depth of the argument map.\n\n3. Dispatch. The host receives %{dry_run: \"false\"}. Any string is truthy in Elixir, so if args.dry_run takes the true branch. A host result carrying booleans was stringified the same way on the way out. The fix in 0.10.1 adds a clause that passes booleans and nil through unchanged."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-104634",
"datePublished": "2026-10-08T13:41:05.745Z",
"dateReserved": "2026-10-04T16:00:02.420Z",
"dateUpdated": "2026-10-08T13:58:34.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104634 (GCVE-0-2026-104634)
Vulnerability from cvelistv5 – Published: 2026-10-08 13:41 – Updated: 2026-10-08 13:58
VLAI
EPSS
VEX
Title
beam_mcp: JSON boolean and null tool arguments reach dispatch as strings
Summary
Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null tool arguments to reach the host's dispatch function as the strings "true", "false" and "nil". After BeamMCP.Schema.validate/2 accepted a value as a boolean, normalize_arguments/2 passed every argument through to_json_value/1, whose atom clause converts true, false and nil to strings. A string is truthy in Elixir, so a host that tests a boolean argument, for example if args.dry_run, takes the opposite branch for false, and a guard such as confirm: false reads as set.
The client controls the argument and could send true directly, so the practical impact is limited to hosts whose behaviour on false differs from their behaviour on true, and to any policy layer in front of the server that permits false but refuses true. The same normalisation applies to prompts/get arguments, which exist from 0.5.0.
This issue affects beam_mcp: from 0.1.0 before 0.10.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 13:58 UTC
CWE
- CWE-704 - Incorrect Type Conversion or Cast
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ScriptKittyOS/beam_mcp/securit… | relatedvendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-104634.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-104634 | related |
| https://github.com/ScriptKittyOS/beam_mcp/commit/… | related |
| https://github.com/ScriptKittyOS/beam_mcp/commit/… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ScriptKittyOS | beam_mcp |
Affected:
0.1.0 , < 0.10.1
(semver)
cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:* |
|
| ScriptKittyOS | beam_mcp |
Affected:
083838eb8e17fe5f6fcaf761bdbe203110288b0b , < 289dbdbad641943b29a3b8d1eb36506cc8cec10a
(git)
cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:* |
Date Public
2026-09-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104634",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T13:58:26.222349Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:58:34.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.BeamMCP.Server\u0027"
],
"packageName": "beam_mcp",
"packageURL": "pkg:hex/beam_mcp",
"product": "beam_mcp",
"programFiles": [
"lib/beam_mcp/server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
},
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:normalize_arguments/2"
},
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:to_json_value/1"
}
],
"repo": "https://github.com/ScriptKittyOS/beam_mcp",
"vendor": "ScriptKittyOS",
"versions": [
{
"lessThan": "0.10.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.BeamMCP.Server\u0027"
],
"packageName": "scriptkittyos/beam_mcp",
"packageURL": "pkg:github/scriptkittyos/beam_mcp",
"product": "beam_mcp",
"programFiles": [
"lib/beam_mcp/server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
},
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:normalize_arguments/2"
},
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:to_json_value/1"
}
],
"repo": "https://github.com/ScriptKittyOS/beam_mcp",
"vendor": "ScriptKittyOS",
"versions": [
{
"lessThan": "289dbdbad641943b29a3b8d1eb36506cc8cec10a",
"status": "affected",
"version": "083838eb8e17fe5f6fcaf761bdbe203110288b0b",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.10.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ayla Croft / Script Kitty OS"
},
{
"lang": "en",
"type": "reporter",
"value": "Ayla Croft / Script Kitty OS"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ayla Croft / Script Kitty OS"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-08T13:40:59.000Z",
"datePublic": "2026-09-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Type Conversion or Cast vulnerability in \u003ccode\u003eBeamMCP.Server\u003c/code\u003e in ScriptKittyOS beam_mcp allows an MCP client\u0027s JSON \u003ccode\u003etrue\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e and \u003ccode\u003enull\u003c/code\u003e tool arguments to reach the host\u0027s dispatch function as the strings \"true\", \"false\" and \"nil\". After \u003ccode\u003eBeamMCP.Schema.validate/2\u003c/code\u003e accepted a value as a boolean, \u003ccode\u003enormalize_arguments/2\u003c/code\u003e passed every argument through \u003ccode\u003eto_json_value/1\u003c/code\u003e, whose atom clause converts \u003ccode\u003etrue\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e and \u003ccode\u003enil\u003c/code\u003e to strings. A string is truthy in Elixir, so a host that tests a boolean argument, for example \u003ccode\u003eif args.dry_run\u003c/code\u003e, takes the opposite branch for \u003ccode\u003efalse\u003c/code\u003e, and a guard such as \u003ccode\u003econfirm: false\u003c/code\u003e reads as set.\u003c/p\u003e\n\u003cp\u003eThe client controls the argument and could send \u003ccode\u003etrue\u003c/code\u003e directly, so the practical impact is limited to hosts whose behaviour on \u003ccode\u003efalse\u003c/code\u003e differs from their behaviour on \u003ccode\u003etrue\u003c/code\u003e, and to any policy layer in front of the server that permits \u003ccode\u003efalse\u003c/code\u003e but refuses \u003ccode\u003etrue\u003c/code\u003e. The same normalisation applies to \u003ccode\u003eprompts/get\u003c/code\u003e arguments, which exist from 0.5.0.\u003c/p\u003e\n\u003cp\u003eThis issue affects beam_mcp: from 0.1.0 before 0.10.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Type Conversion or Cast vulnerability in `BeamMCP.Server` in ScriptKittyOS beam_mcp allows an MCP client\u0027s JSON `true`, `false` and `null` tool arguments to reach the host\u0027s dispatch function as the strings \"true\", \"false\" and \"nil\". After `BeamMCP.Schema.validate/2` accepted a value as a boolean, `normalize_arguments/2` passed every argument through `to_json_value/1`, whose atom clause converts `true`, `false` and `nil` to strings. A string is truthy in Elixir, so a host that tests a boolean argument, for example `if args.dry_run`, takes the opposite branch for `false`, and a guard such as `confirm: false` reads as set.\n\nThe client controls the argument and could send `true` directly, so the practical impact is limited to hosts whose behaviour on `false` differs from their behaviour on `true`, and to any policy layer in front of the server that permits `false` but refuses `true`. The same normalisation applies to `prompts/get` arguments, which exist from 0.5.0.\n\nThis issue affects beam_mcp: from 0.1.0 before 0.10.1."
}
],
"value": "Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client\u0027s JSON true, false and null tool arguments to reach the host\u0027s dispatch function as the strings \"true\", \"false\" and \"nil\". After BeamMCP.Schema.validate/2 accepted a value as a boolean, normalize_arguments/2 passed every argument through to_json_value/1, whose atom clause converts true, false and nil to strings. A string is truthy in Elixir, so a host that tests a boolean argument, for example if args.dry_run, takes the opposite branch for false, and a guard such as confirm: false reads as set.\n\nThe client controls the argument and could send true directly, so the practical impact is limited to hosts whose behaviour on false differs from their behaviour on true, and to any policy layer in front of the server that permits false but refuses true. The same normalisation applies to prompts/get arguments, which exist from 0.5.0.\n\nThis issue affects beam_mcp: from 0.1.0 before 0.10.1."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA host that branches on a boolean argument takes the opposite branch for \u003ccode\u003efalse\u003c/code\u003e, so a safety guard such as \u003ccode\u003econfirm: false\u003c/code\u003e or \u003ccode\u003edry_run: false\u003c/code\u003e is read as set. The client already controls the argument, so the gain over sending \u003ccode\u003etrue\u003c/code\u003e is limited to hosts and intermediaries that treat the two values differently.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A host that branches on a boolean argument takes the opposite branch for `false`, so a safety guard such as `confirm: false` or `dry_run: false` is read as set. The client already controls the argument, so the gain over sending `true` is limited to hosts and intermediaries that treat the two values differently."
}
],
"value": "A host that branches on a boolean argument takes the opposite branch for false, so a safety guard such as confirm: false or dry_run: false is read as set. The client already controls the argument, so the gain over sending true is limited to hosts and intermediaries that treat the two values differently."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-704",
"description": "CWE-704 Incorrect Type Conversion or Cast",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:41:05.745Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GitHub Advisory",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/ScriptKittyOS/beam_mcp/security/advisories/GHSA-wv7p-j6qh-3hj4"
},
{
"name": "EEF CNA record for CVE-2026-104634",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-104634.html"
},
{
"name": "OSV record EEF-CVE-2026-104634",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-104634"
},
{
"name": "Introducing commit 083838e in ScriptKittyOS/beam_mcp",
"tags": [
"related"
],
"url": "https://github.com/ScriptKittyOS/beam_mcp/commit/083838eb8e17fe5f6fcaf761bdbe203110288b0b"
},
{
"name": "Fix commit 289dbdb in ScriptKittyOS/beam_mcp",
"tags": [
"patch"
],
"url": "https://github.com/ScriptKittyOS/beam_mcp/commit/289dbdbad641943b29a3b8d1eb36506cc8cec10a"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "beam_mcp: JSON boolean and null tool arguments reach dispatch as strings",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn the host\u0027s dispatch function, compare boolean arguments against both forms, for example \u003ccode\u003eargs.flag in [true, \"true\"]\u003c/code\u003e and \u003ccode\u003eargs.flag in [false, \"false\"]\u003c/code\u003e, and treat the string \"nil\" as \u003ccode\u003enull\u003c/code\u003e where the schema admits null.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "In the host\u0027s dispatch function, compare boolean arguments against both forms, for example `args.flag in [true, \"true\"]` and `args.flag in [false, \"false\"]`, and treat the string \"nil\" as `null` where the schema admits null."
}
],
"value": "In the host\u0027s dispatch function, compare boolean arguments against both forms, for example args.flag in [true, \"true\"] and args.flag in [false, \"false\"], and treat the string \"nil\" as null where the schema admits null."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eDeclare a tool whose \u003ccode\u003einput_schema\u003c/code\u003e has \u003ccode\u003e\"dry_run\": {\"type\": \"boolean\"}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003etools/call\u003c/code\u003e with \u003ccode\u003e\"arguments\": {\"dry_run\": false}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOn beam_mcp 0.10.0 the dispatch function receives \u003ccode\u003e%{dry_run: \"false\"}\u003c/code\u003e and \u003ccode\u003eif args.dry_run\u003c/code\u003e evaluates the true branch. On 0.10.1 it receives \u003ccode\u003e%{dry_run: false}\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Declare a tool whose `input_schema` has `\"dry_run\": {\"type\": \"boolean\"}`.\n2. Send `tools/call` with `\"arguments\": {\"dry_run\": false}`.\n3. On beam_mcp 0.10.0 the dispatch function receives `%{dry_run: \"false\"}` and `if args.dry_run` evaluates the true branch. On 0.10.1 it receives `%{dry_run: false}`."
}
],
"value": "* Declare a tool whose input_schema has \"dry_run\": {\"type\": \"boolean\"}.\n* Send tools/call with \"arguments\": {\"dry_run\": false}.\n* On beam_mcp 0.10.0 the dispatch function receives %{dry_run: \"false\"} and if args.dry_run evaluates the true branch. On 0.10.1 it receives %{dry_run: false}."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Validation.\u003c/strong\u003e \u003ccode\u003eBeamMCP.Schema.check_type/3\u003c/code\u003e accepts a JSON \u003ccode\u003efalse\u003c/code\u003e for a \u003ccode\u003eboolean\u003c/code\u003e property because the decoded value is the atom \u003ccode\u003efalse\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Normalisation.\u003c/strong\u003e \u003ccode\u003eBeamMCP.Server.normalize_arguments/2\u003c/code\u003e in \u003ccode\u003elib/beam_mcp/server.ex\u003c/code\u003e maps each declared key to an atom and passes each value through \u003ccode\u003eto_json_value/1\u003c/code\u003e. That function was written to encode host results for the wire, and its clause \u003ccode\u003ewhen is_atom(value)\u003c/code\u003e converts the value with \u003ccode\u003eAtom.to_string/1\u003c/code\u003e. \u003ccode\u003etrue\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e and \u003ccode\u003enil\u003c/code\u003e are atoms, so they become the strings \"true\", \"false\" and \"nil\", at any depth of the argument map.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Dispatch.\u003c/strong\u003e The host receives \u003ccode\u003e%{dry_run: \"false\"}\u003c/code\u003e. Any string is truthy in Elixir, so \u003ccode\u003eif args.dry_run\u003c/code\u003e takes the true branch. A host result carrying booleans was stringified the same way on the way out. The fix in 0.10.1 adds a clause that passes booleans and \u003ccode\u003enil\u003c/code\u003e through unchanged.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Validation.** `BeamMCP.Schema.check_type/3` accepts a JSON `false` for a `boolean` property because the decoded value is the atom `false`.\n\n**2. Normalisation.** `BeamMCP.Server.normalize_arguments/2` in `lib/beam_mcp/server.ex` maps each declared key to an atom and passes each value through `to_json_value/1`. That function was written to encode host results for the wire, and its clause `when is_atom(value)` converts the value with `Atom.to_string/1`. `true`, `false` and `nil` are atoms, so they become the strings \"true\", \"false\" and \"nil\", at any depth of the argument map.\n\n**3. Dispatch.** The host receives `%{dry_run: \"false\"}`. Any string is truthy in Elixir, so `if args.dry_run` takes the true branch. A host result carrying booleans was stringified the same way on the way out. The fix in 0.10.1 adds a clause that passes booleans and `nil` through unchanged."
}
],
"value": "1. Validation. BeamMCP.Schema.check_type/3 accepts a JSON false for a boolean property because the decoded value is the atom false.\n\n2. Normalisation. BeamMCP.Server.normalize_arguments/2 in lib/beam_mcp/server.ex maps each declared key to an atom and passes each value through to_json_value/1. That function was written to encode host results for the wire, and its clause when is_atom(value) converts the value with Atom.to_string/1. true, false and nil are atoms, so they become the strings \"true\", \"false\" and \"nil\", at any depth of the argument map.\n\n3. Dispatch. The host receives %{dry_run: \"false\"}. Any string is truthy in Elixir, so if args.dry_run takes the true branch. A host result carrying booleans was stringified the same way on the way out. The fix in 0.10.1 adds a clause that passes booleans and nil through unchanged."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-104634",
"datePublished": "2026-10-08T13:41:05.745Z",
"dateReserved": "2026-10-04T16:00:02.420Z",
"dateUpdated": "2026-10-08T13:58:34.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88257 (GCVE-0-2026-88257)
Vulnerability from cvelistv5 – Published: 2026-10-08 13:40 – Updated: 2026-10-08 14:09
VLAI
EPSS
VEX
Title
beam_mcp: nested tool argument constraints advertised but not enforced
Summary
Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (items, minItems, maxItems, minLength, maxLength, pattern, nested required, enum and additionalProperties: false) were advertised by tools/list and never checked at tools/call or prompts/get, and keywords outside the enforced subset (oneOf, anyOf, $ref) were advertised and ignored.
A host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.
This issue affects beam_mcp: from 0.1.0 before 0.10.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 13:59 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ScriptKittyOS/beam_mcp/securit… | relatedvendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-88257.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-88257 | related |
| https://github.com/ScriptKittyOS/beam_mcp/commit/… | related |
| https://github.com/ScriptKittyOS/beam_mcp/commit/… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ScriptKittyOS | beam_mcp |
Affected:
0.1.0 , < 0.10.1
(semver)
cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:* |
|
| ScriptKittyOS | beam_mcp |
Affected:
083838eb8e17fe5f6fcaf761bdbe203110288b0b , < 289dbdbad641943b29a3b8d1eb36506cc8cec10a
(git)
cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:* |
Date Public
2026-09-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88257",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T13:59:14.866448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:59:33.374Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.BeamMCP.Schema\u0027",
"\u0027Elixir.BeamMCP.Server\u0027"
],
"packageName": "beam_mcp",
"packageURL": "pkg:hex/beam_mcp",
"product": "beam_mcp",
"programFiles": [
"lib/beam_mcp/schema.ex",
"lib/beam_mcp/server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.BeamMCP.Schema\u0027:validate/2"
},
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
}
],
"repo": "https://github.com/ScriptKittyOS/beam_mcp",
"vendor": "ScriptKittyOS",
"versions": [
{
"lessThan": "0.10.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.BeamMCP.Schema\u0027",
"\u0027Elixir.BeamMCP.Server\u0027"
],
"packageName": "scriptkittyos/beam_mcp",
"packageURL": "pkg:github/scriptkittyos/beam_mcp",
"product": "beam_mcp",
"programFiles": [
"lib/beam_mcp/schema.ex",
"lib/beam_mcp/server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.BeamMCP.Schema\u0027:validate/2"
},
{
"name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
}
],
"repo": "https://github.com/ScriptKittyOS/beam_mcp",
"vendor": "ScriptKittyOS",
"versions": [
{
"lessThan": "289dbdbad641943b29a3b8d1eb36506cc8cec10a",
"status": "affected",
"version": "083838eb8e17fe5f6fcaf761bdbe203110288b0b",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.10.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ayla Croft / Script Kitty OS"
},
{
"lang": "en",
"type": "reporter",
"value": "Ayla Croft / Script Kitty OS"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ayla Croft / Script Kitty OS"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-08T13:40:44.000Z",
"datePublic": "2026-09-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Input Validation vulnerability in \u003ccode\u003eBeamMCP.Schema\u003c/code\u003e in ScriptKittyOS beam_mcp allows an MCP client to reach a tool\u0027s dispatch function with arguments that violate the input schema the server advertised. \u003ccode\u003eBeamMCP.Schema.validate/2\u003c/code\u003e checked \u003ccode\u003etype\u003c/code\u003e, \u003ccode\u003erequired\u003c/code\u003e, \u003ccode\u003eadditionalProperties\u003c/code\u003e, \u003ccode\u003eenum\u003c/code\u003e and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (\u003ccode\u003eitems\u003c/code\u003e, \u003ccode\u003eminItems\u003c/code\u003e, \u003ccode\u003emaxItems\u003c/code\u003e, \u003ccode\u003eminLength\u003c/code\u003e, \u003ccode\u003emaxLength\u003c/code\u003e, \u003ccode\u003epattern\u003c/code\u003e, nested \u003ccode\u003erequired\u003c/code\u003e, \u003ccode\u003eenum\u003c/code\u003e and \u003ccode\u003eadditionalProperties: false\u003c/code\u003e) were advertised by \u003ccode\u003etools/list\u003c/code\u003e and never checked at \u003ccode\u003etools/call\u003c/code\u003e or \u003ccode\u003eprompts/get\u003c/code\u003e, and keywords outside the enforced subset (\u003ccode\u003eoneOf\u003c/code\u003e, \u003ccode\u003eanyOf\u003c/code\u003e, \u003ccode\u003e$ref\u003c/code\u003e) were advertised and ignored.\u003c/p\u003e\n\u003cp\u003eA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.\u003c/p\u003e\n\u003cp\u003eThis issue affects beam_mcp: from 0.1.0 before 0.10.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Input Validation vulnerability in `BeamMCP.Schema` in ScriptKittyOS beam_mcp allows an MCP client to reach a tool\u0027s dispatch function with arguments that violate the input schema the server advertised. `BeamMCP.Schema.validate/2` checked `type`, `required`, `additionalProperties`, `enum` and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (`items`, `minItems`, `maxItems`, `minLength`, `maxLength`, `pattern`, nested `required`, `enum` and `additionalProperties: false`) were advertised by `tools/list` and never checked at `tools/call` or `prompts/get`, and keywords outside the enforced subset (`oneOf`, `anyOf`, `$ref`) were advertised and ignored.\n\nA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.\n\nThis issue affects beam_mcp: from 0.1.0 before 0.10.1."
}
],
"value": "Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool\u0027s dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (items, minItems, maxItems, minLength, maxLength, pattern, nested required, enum and additionalProperties: false) were advertised by tools/list and never checked at tools/call or prompts/get, and keywords outside the enforced subset (oneOf, anyOf, $ref) were advertised and ignored.\n\nA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.\n\nThis issue affects beam_mcp: from 0.1.0 before 0.10.1."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn MCP client can hand a host\u0027s tool values the host\u0027s declared schema forbids, such as an out-of-range number or an undeclared key inside a nested object. The consequence depends on what the host\u0027s dispatch code does with a value it never expected to receive.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An MCP client can hand a host\u0027s tool values the host\u0027s declared schema forbids, such as an out-of-range number or an undeclared key inside a nested object. The consequence depends on what the host\u0027s dispatch code does with a value it never expected to receive."
}
],
"value": "An MCP client can hand a host\u0027s tool values the host\u0027s declared schema forbids, such as an out-of-range number or an undeclared key inside a nested object. The consequence depends on what the host\u0027s dispatch code does with a value it never expected to receive."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:09:41.540Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GitHub Advisory",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/ScriptKittyOS/beam_mcp/security/advisories/GHSA-mrg2-4747-fmpw"
},
{
"name": "EEF CNA record for CVE-2026-88257",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-88257.html"
},
{
"name": "OSV record EEF-CVE-2026-88257",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-88257"
},
{
"name": "Introducing commit 083838e in ScriptKittyOS/beam_mcp",
"tags": [
"related"
],
"url": "https://github.com/ScriptKittyOS/beam_mcp/commit/083838eb8e17fe5f6fcaf761bdbe203110288b0b"
},
{
"name": "Fix commit 289dbdb in ScriptKittyOS/beam_mcp",
"tags": [
"patch"
],
"url": "https://github.com/ScriptKittyOS/beam_mcp/commit/289dbdbad641943b29a3b8d1eb36506cc8cec10a"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "beam_mcp: nested tool argument constraints advertised but not enforced",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRe-validate the arguments inside the host\u0027s dispatch function against every constraint the schema declares below the top level, or move each constraint to a top-level property, which the affected versions do enforce.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Re-validate the arguments inside the host\u0027s dispatch function against every constraint the schema declares below the top level, or move each constraint to a top-level property, which the affected versions do enforce."
}
],
"value": "Re-validate the arguments inside the host\u0027s dispatch function against every constraint the schema declares below the top level, or move each constraint to a top-level property, which the affected versions do enforce."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eDeclare a tool whose \u003ccode\u003einput_schema\u003c/code\u003e has a nested object property \u003ccode\u003eopts\u003c/code\u003e with \u003ccode\u003e\"properties\": {\"level\": {\"type\": \"integer\", \"maximum\": 3}}\u003c/code\u003e, \u003ccode\u003e\"required\": [\"level\"]\u003c/code\u003e and \u003ccode\u003e\"additionalProperties\": false\u003c/code\u003e, and an array property \u003ccode\u003etags\u003c/code\u003e with \u003ccode\u003e\"items\": {\"type\": \"string\"}\u003c/code\u003e and \u003ccode\u003e\"maxItems\": 2\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003etools/call\u003c/code\u003e with \u003ccode\u003e\"arguments\": {\"opts\": {\"level\": 99, \"extra\": \"x\"}}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOn beam_mcp 0.10.0 the dispatch function receives \u003ccode\u003e%{opts: %{\"extra\" =\u0026gt; \"x\", \"level\" =\u0026gt; 99}}\u003c/code\u003e. On 0.10.1 the call is refused with \u003ccode\u003einvalid arguments: unknown property: opts.extra\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003e\"arguments\": {\"tags\": [1, 2, 3]}\u003c/code\u003e. On 0.10.0 the dispatch function receives \u003ccode\u003etags: [1, 2, 3]\u003c/code\u003e. On 0.10.1 the call is refused with \u003ccode\u003etags must have at most 2 items\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Declare a tool whose `input_schema` has a nested object property `opts` with `\"properties\": {\"level\": {\"type\": \"integer\", \"maximum\": 3}}`, `\"required\": [\"level\"]` and `\"additionalProperties\": false`, and an array property `tags` with `\"items\": {\"type\": \"string\"}` and `\"maxItems\": 2`.\n2. Send `tools/call` with `\"arguments\": {\"opts\": {\"level\": 99, \"extra\": \"x\"}}`.\n3. On beam_mcp 0.10.0 the dispatch function receives `%{opts: %{\"extra\" =\u003e \"x\", \"level\" =\u003e 99}}`. On 0.10.1 the call is refused with `invalid arguments: unknown property: opts.extra`.\n4. Send `\"arguments\": {\"tags\": [1, 2, 3]}`. On 0.10.0 the dispatch function receives `tags: [1, 2, 3]`. On 0.10.1 the call is refused with `tags must have at most 2 items`."
}
],
"value": "* Declare a tool whose input_schema has a nested object property opts with \"properties\": {\"level\": {\"type\": \"integer\", \"maximum\": 3}}, \"required\": [\"level\"] and \"additionalProperties\": false, and an array property tags with \"items\": {\"type\": \"string\"} and \"maxItems\": 2.\n* Send tools/call with \"arguments\": {\"opts\": {\"level\": 99, \"extra\": \"x\"}}.\n* On beam_mcp 0.10.0 the dispatch function receives %{opts: %{\"extra\" =\u003e \"x\", \"level\" =\u003e 99}}. On 0.10.1 the call is refused with invalid arguments: unknown property: opts.extra.\n* Send \"arguments\": {\"tags\": [1, 2, 3]}. On 0.10.0 the dispatch function receives tags: [1, 2, 3]. On 0.10.1 the call is refused with tags must have at most 2 items."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Advertising.\u003c/strong\u003e \u003ccode\u003etools/list\u003c/code\u003e returns each tool\u0027s \u003ccode\u003einput_schema\u003c/code\u003e verbatim, including nested \u003ccode\u003eproperties\u003c/code\u003e, \u003ccode\u003eitems\u003c/code\u003e and constraint keywords.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Validation.\u003c/strong\u003e \u003ccode\u003eBeamMCP.Schema.validate/2\u003c/code\u003e in \u003ccode\u003elib/beam_mcp/schema.ex\u003c/code\u003e walks only the first level: \u003ccode\u003echeck_required/2\u003c/code\u003e and \u003ccode\u003echeck_additional/3\u003c/code\u003e run on the top-level object, and \u003ccode\u003echeck_properties/2\u003c/code\u003e applies \u003ccode\u003echeck_type\u003c/code\u003e, \u003ccode\u003echeck_enum\u003c/code\u003e and \u003ccode\u003echeck_range\u003c/code\u003e to each top-level value. A value of type \u003ccode\u003eobject\u003c/code\u003e or \u003ccode\u003earray\u003c/code\u003e is accepted once its own type matches, and its contents are not visited. Keywords the validator does not know are ignored.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Dispatch.\u003c/strong\u003e \u003ccode\u003eBeamMCP.Server.validate_and_dispatch/3\u003c/code\u003e passes the accepted arguments to \u003ccode\u003enormalize_arguments/2\u003c/code\u003e and then to the host\u0027s dispatch function, so an undeclared key inside a nested object, an out-of-range nested number, or an array item of the wrong type reaches host code that believed the schema excluded it. The same validator runs on \u003ccode\u003eprompts/get\u003c/code\u003e arguments. The fix in 0.10.1 enforces every keyword of the documented subset at every depth and refuses a schema that uses any other keyword when the catalog is loaded.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Advertising.** `tools/list` returns each tool\u0027s `input_schema` verbatim, including nested `properties`, `items` and constraint keywords.\n\n**2. Validation.** `BeamMCP.Schema.validate/2` in `lib/beam_mcp/schema.ex` walks only the first level: `check_required/2` and `check_additional/3` run on the top-level object, and `check_properties/2` applies `check_type`, `check_enum` and `check_range` to each top-level value. A value of type `object` or `array` is accepted once its own type matches, and its contents are not visited. Keywords the validator does not know are ignored.\n\n**3. Dispatch.** `BeamMCP.Server.validate_and_dispatch/3` passes the accepted arguments to `normalize_arguments/2` and then to the host\u0027s dispatch function, so an undeclared key inside a nested object, an out-of-range nested number, or an array item of the wrong type reaches host code that believed the schema excluded it. The same validator runs on `prompts/get` arguments. The fix in 0.10.1 enforces every keyword of the documented subset at every depth and refuses a schema that uses any other keyword when the catalog is loaded."
}
],
"value": "1. Advertising. tools/list returns each tool\u0027s input_schema verbatim, including nested properties, items and constraint keywords.\n\n2. Validation. BeamMCP.Schema.validate/2 in lib/beam_mcp/schema.ex walks only the first level: check_required/2 and check_additional/3 run on the top-level object, and check_properties/2 applies check_type, check_enum and check_range to each top-level value. A value of type object or array is accepted once its own type matches, and its contents are not visited. Keywords the validator does not know are ignored.\n\n3. Dispatch. BeamMCP.Server.validate_and_dispatch/3 passes the accepted arguments to normalize_arguments/2 and then to the host\u0027s dispatch function, so an undeclared key inside a nested object, an out-of-range nested number, or an array item of the wrong type reaches host code that believed the schema excluded it. The same validator runs on prompts/get arguments. The fix in 0.10.1 enforces every keyword of the documented subset at every depth and refuses a schema that uses any other keyword when the catalog is loaded."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-88257",
"datePublished": "2026-10-08T13:40:55.828Z",
"dateReserved": "2026-10-07T22:15:01.878Z",
"dateUpdated": "2026-10-08T14:09:41.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}