CVE-2026-88257 (GCVE-0-2026-88257)

Vulnerability from cvelistv5 – Published: 2026-10-08 13:40 – Updated: 2026-10-08 14:09
VLAI
Title
beam_mcp: nested tool argument constraints advertised but not enforced
Summary
Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (items, minItems, maxItems, minLength, maxLength, pattern, nested required, enum and additionalProperties: false) were advertised by tools/list and never checked at tools/call or prompts/get, and keywords outside the enforced subset (oneOf, anyOf, $ref) were advertised and ignored. A host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact. This issue affects beam_mcp: from 0.1.0 before 0.10.1.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 13:59 UTC
CWE
  • CWE-20 - Improper Input Validation
Assigner
EEF CNA under the mitre root
CNA scorecard A 96/100 over 297 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
ScriptKittyOS beam_mcp Affected: 0.1.0 , < 0.10.1 (semver)
    cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*
Create a notification for this product.
ScriptKittyOS beam_mcp Affected: 083838eb8e17fe5f6fcaf761bdbe203110288b0b , < 289dbdbad641943b29a3b8d1eb36506cc8cec10a (git)
    cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-09-26 00:00
Credits
Ayla Croft / Script Kitty OS Ayla Croft / Script Kitty OS Ayla Croft / Script Kitty OS Jonatan Männchen / EEF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-88257",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T13:59:14.866448Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T13:59:33.374Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.BeamMCP.Schema\u0027",
            "\u0027Elixir.BeamMCP.Server\u0027"
          ],
          "packageName": "beam_mcp",
          "packageURL": "pkg:hex/beam_mcp",
          "product": "beam_mcp",
          "programFiles": [
            "lib/beam_mcp/schema.ex",
            "lib/beam_mcp/server.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.BeamMCP.Schema\u0027:validate/2"
            },
            {
              "name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
            }
          ],
          "repo": "https://github.com/ScriptKittyOS/beam_mcp",
          "vendor": "ScriptKittyOS",
          "versions": [
            {
              "lessThan": "0.10.1",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.BeamMCP.Schema\u0027",
            "\u0027Elixir.BeamMCP.Server\u0027"
          ],
          "packageName": "scriptkittyos/beam_mcp",
          "packageURL": "pkg:github/scriptkittyos/beam_mcp",
          "product": "beam_mcp",
          "programFiles": [
            "lib/beam_mcp/schema.ex",
            "lib/beam_mcp/server.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.BeamMCP.Schema\u0027:validate/2"
            },
            {
              "name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
            }
          ],
          "repo": "https://github.com/ScriptKittyOS/beam_mcp",
          "vendor": "ScriptKittyOS",
          "versions": [
            {
              "lessThan": "289dbdbad641943b29a3b8d1eb36506cc8cec10a",
              "status": "affected",
              "version": "083838eb8e17fe5f6fcaf761bdbe203110288b0b",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.10.1",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ayla Croft / Script Kitty OS"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ayla Croft / Script Kitty OS"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ayla Croft / Script Kitty OS"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-10-08T13:40:44.000Z",
      "datePublic": "2026-09-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Input Validation vulnerability in \u003ccode\u003eBeamMCP.Schema\u003c/code\u003e in ScriptKittyOS beam_mcp allows an MCP client to reach a tool\u0027s dispatch function with arguments that violate the input schema the server advertised. \u003ccode\u003eBeamMCP.Schema.validate/2\u003c/code\u003e checked \u003ccode\u003etype\u003c/code\u003e, \u003ccode\u003erequired\u003c/code\u003e, \u003ccode\u003eadditionalProperties\u003c/code\u003e, \u003ccode\u003eenum\u003c/code\u003e and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (\u003ccode\u003eitems\u003c/code\u003e, \u003ccode\u003eminItems\u003c/code\u003e, \u003ccode\u003emaxItems\u003c/code\u003e, \u003ccode\u003eminLength\u003c/code\u003e, \u003ccode\u003emaxLength\u003c/code\u003e, \u003ccode\u003epattern\u003c/code\u003e, nested \u003ccode\u003erequired\u003c/code\u003e, \u003ccode\u003eenum\u003c/code\u003e and \u003ccode\u003eadditionalProperties: false\u003c/code\u003e) were advertised by \u003ccode\u003etools/list\u003c/code\u003e and never checked at \u003ccode\u003etools/call\u003c/code\u003e or \u003ccode\u003eprompts/get\u003c/code\u003e, and keywords outside the enforced subset (\u003ccode\u003eoneOf\u003c/code\u003e, \u003ccode\u003eanyOf\u003c/code\u003e, \u003ccode\u003e$ref\u003c/code\u003e) were advertised and ignored.\u003c/p\u003e\n\u003cp\u003eA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.\u003c/p\u003e\n\u003cp\u003eThis issue affects beam_mcp: from 0.1.0 before 0.10.1.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Input Validation vulnerability in `BeamMCP.Schema` in ScriptKittyOS beam_mcp allows an MCP client to reach a tool\u0027s dispatch function with arguments that violate the input schema the server advertised. `BeamMCP.Schema.validate/2` checked `type`, `required`, `additionalProperties`, `enum` and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (`items`, `minItems`, `maxItems`, `minLength`, `maxLength`, `pattern`, nested `required`, `enum` and `additionalProperties: false`) were advertised by `tools/list` and never checked at `tools/call` or `prompts/get`, and keywords outside the enforced subset (`oneOf`, `anyOf`, `$ref`) were advertised and ignored.\n\nA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.\n\nThis issue affects beam_mcp: from 0.1.0 before 0.10.1."
            }
          ],
          "value": "Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool\u0027s dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (items, minItems, maxItems, minLength, maxLength, pattern, nested required, enum and additionalProperties: false) were advertised by tools/list and never checked at tools/call or prompts/get, and keywords outside the enforced subset (oneOf, anyOf, $ref) were advertised and ignored.\n\nA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.\n\nThis issue affects beam_mcp: from 0.1.0 before 0.10.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn MCP client can hand a host\u0027s tool values the host\u0027s declared schema forbids, such as an out-of-range number or an undeclared key inside a nested object. The consequence depends on what the host\u0027s dispatch code does with a value it never expected to receive.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An MCP client can hand a host\u0027s tool values the host\u0027s declared schema forbids, such as an out-of-range number or an undeclared key inside a nested object. The consequence depends on what the host\u0027s dispatch code does with a value it never expected to receive."
                }
              ],
              "value": "An MCP client can hand a host\u0027s tool values the host\u0027s declared schema forbids, such as an out-of-range number or an undeclared key inside a nested object. The consequence depends on what the host\u0027s dispatch code does with a value it never expected to receive."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T14:09:41.540Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "GitHub Advisory",
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/ScriptKittyOS/beam_mcp/security/advisories/GHSA-mrg2-4747-fmpw"
        },
        {
          "name": "EEF CNA record for CVE-2026-88257",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-88257.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-88257",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-88257"
        },
        {
          "name": "Introducing commit 083838e in ScriptKittyOS/beam_mcp",
          "tags": [
            "related"
          ],
          "url": "https://github.com/ScriptKittyOS/beam_mcp/commit/083838eb8e17fe5f6fcaf761bdbe203110288b0b"
        },
        {
          "name": "Fix commit 289dbdb in ScriptKittyOS/beam_mcp",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ScriptKittyOS/beam_mcp/commit/289dbdbad641943b29a3b8d1eb36506cc8cec10a"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "beam_mcp: nested tool argument constraints advertised but not enforced",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRe-validate the arguments inside the host\u0027s dispatch function against every constraint the schema declares below the top level, or move each constraint to a top-level property, which the affected versions do enforce.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Re-validate the arguments inside the host\u0027s dispatch function against every constraint the schema declares below the top level, or move each constraint to a top-level property, which the affected versions do enforce."
            }
          ],
          "value": "Re-validate the arguments inside the host\u0027s dispatch function against every constraint the schema declares below the top level, or move each constraint to a top-level property, which the affected versions do enforce."
        }
      ],
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\n\u003cli\u003eDeclare a tool whose \u003ccode\u003einput_schema\u003c/code\u003e has a nested object property \u003ccode\u003eopts\u003c/code\u003e with \u003ccode\u003e\"properties\": {\"level\": {\"type\": \"integer\", \"maximum\": 3}}\u003c/code\u003e, \u003ccode\u003e\"required\": [\"level\"]\u003c/code\u003e and \u003ccode\u003e\"additionalProperties\": false\u003c/code\u003e, and an array property \u003ccode\u003etags\u003c/code\u003e with \u003ccode\u003e\"items\": {\"type\": \"string\"}\u003c/code\u003e and \u003ccode\u003e\"maxItems\": 2\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003etools/call\u003c/code\u003e with \u003ccode\u003e\"arguments\": {\"opts\": {\"level\": 99, \"extra\": \"x\"}}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOn beam_mcp 0.10.0 the dispatch function receives \u003ccode\u003e%{opts: %{\"extra\" =\u0026gt; \"x\", \"level\" =\u0026gt; 99}}\u003c/code\u003e. On 0.10.1 the call is refused with \u003ccode\u003einvalid arguments: unknown property: opts.extra\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003e\"arguments\": {\"tags\": [1, 2, 3]}\u003c/code\u003e. On 0.10.0 the dispatch function receives \u003ccode\u003etags: [1, 2, 3]\u003c/code\u003e. On 0.10.1 the call is refused with \u003ccode\u003etags must have at most 2 items\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "1. Declare a tool whose `input_schema` has a nested object property `opts` with `\"properties\": {\"level\": {\"type\": \"integer\", \"maximum\": 3}}`, `\"required\": [\"level\"]` and `\"additionalProperties\": false`, and an array property `tags` with `\"items\": {\"type\": \"string\"}` and `\"maxItems\": 2`.\n2. Send `tools/call` with `\"arguments\": {\"opts\": {\"level\": 99, \"extra\": \"x\"}}`.\n3. On beam_mcp 0.10.0 the dispatch function receives `%{opts: %{\"extra\" =\u003e \"x\", \"level\" =\u003e 99}}`. On 0.10.1 the call is refused with `invalid arguments: unknown property: opts.extra`.\n4. Send `\"arguments\": {\"tags\": [1, 2, 3]}`. On 0.10.0 the dispatch function receives `tags: [1, 2, 3]`. On 0.10.1 the call is refused with `tags must have at most 2 items`."
            }
          ],
          "value": "* Declare a tool whose input_schema has a nested object property opts with \"properties\": {\"level\": {\"type\": \"integer\", \"maximum\": 3}}, \"required\": [\"level\"] and \"additionalProperties\": false, and an array property tags with \"items\": {\"type\": \"string\"} and \"maxItems\": 2.\n* Send tools/call with \"arguments\": {\"opts\": {\"level\": 99, \"extra\": \"x\"}}.\n* On beam_mcp 0.10.0 the dispatch function receives %{opts: %{\"extra\" =\u003e \"x\", \"level\" =\u003e 99}}. On 0.10.1 the call is refused with invalid arguments: unknown property: opts.extra.\n* Send \"arguments\": {\"tags\": [1, 2, 3]}. On 0.10.0 the dispatch function receives tags: [1, 2, 3]. On 0.10.1 the call is refused with tags must have at most 2 items."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003e1. Advertising.\u003c/strong\u003e \u003ccode\u003etools/list\u003c/code\u003e returns each tool\u0027s \u003ccode\u003einput_schema\u003c/code\u003e verbatim, including nested \u003ccode\u003eproperties\u003c/code\u003e, \u003ccode\u003eitems\u003c/code\u003e and constraint keywords.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Validation.\u003c/strong\u003e \u003ccode\u003eBeamMCP.Schema.validate/2\u003c/code\u003e in \u003ccode\u003elib/beam_mcp/schema.ex\u003c/code\u003e walks only the first level: \u003ccode\u003echeck_required/2\u003c/code\u003e and \u003ccode\u003echeck_additional/3\u003c/code\u003e run on the top-level object, and \u003ccode\u003echeck_properties/2\u003c/code\u003e applies \u003ccode\u003echeck_type\u003c/code\u003e, \u003ccode\u003echeck_enum\u003c/code\u003e and \u003ccode\u003echeck_range\u003c/code\u003e to each top-level value. A value of type \u003ccode\u003eobject\u003c/code\u003e or \u003ccode\u003earray\u003c/code\u003e is accepted once its own type matches, and its contents are not visited. Keywords the validator does not know are ignored.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Dispatch.\u003c/strong\u003e \u003ccode\u003eBeamMCP.Server.validate_and_dispatch/3\u003c/code\u003e passes the accepted arguments to \u003ccode\u003enormalize_arguments/2\u003c/code\u003e and then to the host\u0027s dispatch function, so an undeclared key inside a nested object, an out-of-range nested number, or an array item of the wrong type reaches host code that believed the schema excluded it. The same validator runs on \u003ccode\u003eprompts/get\u003c/code\u003e arguments. The fix in 0.10.1 enforces every keyword of the documented subset at every depth and refuses a schema that uses any other keyword when the catalog is loaded.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "**1. Advertising.** `tools/list` returns each tool\u0027s `input_schema` verbatim, including nested `properties`, `items` and constraint keywords.\n\n**2. Validation.** `BeamMCP.Schema.validate/2` in `lib/beam_mcp/schema.ex` walks only the first level: `check_required/2` and `check_additional/3` run on the top-level object, and `check_properties/2` applies `check_type`, `check_enum` and `check_range` to each top-level value. A value of type `object` or `array` is accepted once its own type matches, and its contents are not visited. Keywords the validator does not know are ignored.\n\n**3. Dispatch.** `BeamMCP.Server.validate_and_dispatch/3` passes the accepted arguments to `normalize_arguments/2` and then to the host\u0027s dispatch function, so an undeclared key inside a nested object, an out-of-range nested number, or an array item of the wrong type reaches host code that believed the schema excluded it. The same validator runs on `prompts/get` arguments. The fix in 0.10.1 enforces every keyword of the documented subset at every depth and refuses a schema that uses any other keyword when the catalog is loaded."
            }
          ],
          "value": "1. Advertising. tools/list returns each tool\u0027s input_schema verbatim, including nested properties, items and constraint keywords.\n\n2. Validation. BeamMCP.Schema.validate/2 in lib/beam_mcp/schema.ex walks only the first level: check_required/2 and check_additional/3 run on the top-level object, and check_properties/2 applies check_type, check_enum and check_range to each top-level value. A value of type object or array is accepted once its own type matches, and its contents are not visited. Keywords the validator does not know are ignored.\n\n3. Dispatch. BeamMCP.Server.validate_and_dispatch/3 passes the accepted arguments to normalize_arguments/2 and then to the host\u0027s dispatch function, so an undeclared key inside a nested object, an out-of-range nested number, or an array item of the wrong type reaches host code that believed the schema excluded it. The same validator runs on prompts/get arguments. The fix in 0.10.1 enforces every keyword of the documented subset at every depth and refuses a schema that uses any other keyword when the catalog is loaded."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-88257",
    "datePublished": "2026-10-08T13:40:55.828Z",
    "dateReserved": "2026-10-07T22:15:01.878Z",
    "dateUpdated": "2026-10-08T14:09:41.540Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-88257",
      "date": "2026-10-09",
      "epss": "0.00268",
      "percentile": "0.17411"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.BeamMCP.Schema\u0027",
                  "\u0027Elixir.BeamMCP.Server\u0027"
                ],
                "packageName": "beam_mcp",
                "packageURL": "pkg:hex/beam_mcp",
                "product": "beam_mcp",
                "programFiles": [
                  "lib/beam_mcp/schema.ex",
                  "lib/beam_mcp/server.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.BeamMCP.Schema\u0027:validate/2"
                  },
                  {
                    "name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
                  }
                ],
                "repo": "https://github.com/ScriptKittyOS/beam_mcp",
                "vendor": "ScriptKittyOS",
                "versions": [
                  {
                    "lessThan": "0.10.1",
                    "status": "affected",
                    "version": "0.1.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.BeamMCP.Schema\u0027",
                  "\u0027Elixir.BeamMCP.Server\u0027"
                ],
                "packageName": "scriptkittyos/beam_mcp",
                "packageURL": "pkg:github/scriptkittyos/beam_mcp",
                "product": "beam_mcp",
                "programFiles": [
                  "lib/beam_mcp/schema.ex",
                  "lib/beam_mcp/server.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.BeamMCP.Schema\u0027:validate/2"
                  },
                  {
                    "name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
                  }
                ],
                "repo": "https://github.com/ScriptKittyOS/beam_mcp",
                "vendor": "ScriptKittyOS",
                "versions": [
                  {
                    "lessThan": "289dbdbad641943b29a3b8d1eb36506cc8cec10a",
                    "status": "affected",
                    "version": "083838eb8e17fe5f6fcaf761bdbe203110288b0b",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool\u0027s dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (items, minItems, maxItems, minLength, maxLength, pattern, nested required, enum and additionalProperties: false) were advertised by tools/list and never checked at tools/call or prompts/get, and keywords outside the enforced subset (oneOf, anyOf, $ref) were advertised and ignored.\n\nA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.\n\nThis issue affects beam_mcp: from 0.1.0 before 0.10.1."
          }
        ],
        "id": "CVE-2026-88257",
        "lastModified": "2026-10-08T21:01:07.830",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-88257",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T13:59:14.866448Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-08T14:17:01.613",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-88257.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ScriptKittyOS/beam_mcp/commit/083838eb8e17fe5f6fcaf761bdbe203110288b0b"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ScriptKittyOS/beam_mcp/commit/289dbdbad641943b29a3b8d1eb36506cc8cec10a"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ScriptKittyOS/beam_mcp/security/advisories/GHSA-mrg2-4747-fmpw"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-88257"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-88257",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-08T13:59:14.866448Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-08T13:59:26.255Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.BeamMCP.Schema\u0027",
                "\u0027Elixir.BeamMCP.Server\u0027"
              ],
              "packageName": "beam_mcp",
              "packageURL": "pkg:hex/beam_mcp",
              "product": "beam_mcp",
              "programFiles": [
                "lib/beam_mcp/schema.ex",
                "lib/beam_mcp/server.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.BeamMCP.Schema\u0027:validate/2"
                },
                {
                  "name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
                }
              ],
              "repo": "https://github.com/ScriptKittyOS/beam_mcp",
              "vendor": "ScriptKittyOS",
              "versions": [
                {
                  "lessThan": "0.10.1",
                  "status": "affected",
                  "version": "0.1.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.BeamMCP.Schema\u0027",
                "\u0027Elixir.BeamMCP.Server\u0027"
              ],
              "packageName": "scriptkittyos/beam_mcp",
              "packageURL": "pkg:github/scriptkittyos/beam_mcp",
              "product": "beam_mcp",
              "programFiles": [
                "lib/beam_mcp/schema.ex",
                "lib/beam_mcp/server.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.BeamMCP.Schema\u0027:validate/2"
                },
                {
                  "name": "\u0027Elixir.BeamMCP.Server\u0027:handle_message/2"
                }
              ],
              "repo": "https://github.com/ScriptKittyOS/beam_mcp",
              "vendor": "ScriptKittyOS",
              "versions": [
                {
                  "lessThan": "289dbdbad641943b29a3b8d1eb36506cc8cec10a",
                  "status": "affected",
                  "version": "083838eb8e17fe5f6fcaf761bdbe203110288b0b",
                  "versionType": "git"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:scriptkittyos:beam_mcp:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "0.10.1",
                      "versionStartIncluding": "0.1.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Ayla Croft / Script Kitty OS"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Ayla Croft / Script Kitty OS"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Ayla Croft / Script Kitty OS"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "dateAssigned": "2026-10-08T13:40:44.000Z",
          "datePublic": "2026-09-26T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eImproper Input Validation vulnerability in \u003ccode\u003eBeamMCP.Schema\u003c/code\u003e in ScriptKittyOS beam_mcp allows an MCP client to reach a tool\u0027s dispatch function with arguments that violate the input schema the server advertised. \u003ccode\u003eBeamMCP.Schema.validate/2\u003c/code\u003e checked \u003ccode\u003etype\u003c/code\u003e, \u003ccode\u003erequired\u003c/code\u003e, \u003ccode\u003eadditionalProperties\u003c/code\u003e, \u003ccode\u003eenum\u003c/code\u003e and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (\u003ccode\u003eitems\u003c/code\u003e, \u003ccode\u003eminItems\u003c/code\u003e, \u003ccode\u003emaxItems\u003c/code\u003e, \u003ccode\u003eminLength\u003c/code\u003e, \u003ccode\u003emaxLength\u003c/code\u003e, \u003ccode\u003epattern\u003c/code\u003e, nested \u003ccode\u003erequired\u003c/code\u003e, \u003ccode\u003eenum\u003c/code\u003e and \u003ccode\u003eadditionalProperties: false\u003c/code\u003e) were advertised by \u003ccode\u003etools/list\u003c/code\u003e and never checked at \u003ccode\u003etools/call\u003c/code\u003e or \u003ccode\u003eprompts/get\u003c/code\u003e, and keywords outside the enforced subset (\u003ccode\u003eoneOf\u003c/code\u003e, \u003ccode\u003eanyOf\u003c/code\u003e, \u003ccode\u003e$ref\u003c/code\u003e) were advertised and ignored.\u003c/p\u003e\n\u003cp\u003eA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.\u003c/p\u003e\n\u003cp\u003eThis issue affects beam_mcp: from 0.1.0 before 0.10.1.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Improper Input Validation vulnerability in `BeamMCP.Schema` in ScriptKittyOS beam_mcp allows an MCP client to reach a tool\u0027s dispatch function with arguments that violate the input schema the server advertised. `BeamMCP.Schema.validate/2` checked `type`, `required`, `additionalProperties`, `enum` and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (`items`, `minItems`, `maxItems`, `minLength`, `maxLength`, `pattern`, nested `required`, `enum` and `additionalProperties: false`) were advertised by `tools/list` and never checked at `tools/call` or `prompts/get`, and keywords outside the enforced subset (`oneOf`, `anyOf`, `$ref`) were advertised and ignored.\n\nA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.\n\nThis issue affects beam_mcp: from 0.1.0 before 0.10.1."
                }
              ],
              "value": "Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool\u0027s dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (items, minItems, maxItems, minLength, maxLength, pattern, nested required, enum and additionalProperties: false) were advertised by tools/list and never checked at tools/call or prompts/get, and keywords outside the enforced subset (oneOf, anyOf, $ref) were advertised and ignored.\n\nA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.\n\nThis issue affects beam_mcp: from 0.1.0 before 0.10.1."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-153",
              "descriptions": [
                {
                  "lang": "en",
                  "supportingMedia": [
                    {
                      "base64": false,
                      "type": "text/html",
                      "value": "\u003cp\u003eAn MCP client can hand a host\u0027s tool values the host\u0027s declared schema forbids, such as an out-of-range number or an undeclared key inside a nested object. The consequence depends on what the host\u0027s dispatch code does with a value it never expected to receive.\u003c/p\u003e"
                    },
                    {
                      "base64": false,
                      "type": "text/markdown",
                      "value": "An MCP client can hand a host\u0027s tool values the host\u0027s declared schema forbids, such as an out-of-range number or an undeclared key inside a nested object. The consequence depends on what the host\u0027s dispatch code does with a value it never expected to receive."
                    }
                  ],
                  "value": "An MCP client can hand a host\u0027s tool values the host\u0027s declared schema forbids, such as an out-of-range number or an undeclared key inside a nested object. The consequence depends on what the host\u0027s dispatch code does with a value it never expected to receive."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-20",
                  "description": "CWE-20 Improper Input Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-08T14:09:41.540Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "name": "GitHub Advisory",
              "tags": [
                "related",
                "vendor-advisory"
              ],
              "url": "https://github.com/ScriptKittyOS/beam_mcp/security/advisories/GHSA-mrg2-4747-fmpw"
            },
            {
              "name": "EEF CNA record for CVE-2026-88257",
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-88257.html"
            },
            {
              "name": "OSV record EEF-CVE-2026-88257",
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-88257"
            },
            {
              "name": "Introducing commit 083838e in ScriptKittyOS/beam_mcp",
              "tags": [
                "related"
              ],
              "url": "https://github.com/ScriptKittyOS/beam_mcp/commit/083838eb8e17fe5f6fcaf761bdbe203110288b0b"
            },
            {
              "name": "Fix commit 289dbdb in ScriptKittyOS/beam_mcp",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/ScriptKittyOS/beam_mcp/commit/289dbdbad641943b29a3b8d1eb36506cc8cec10a"
            }
          ],
          "source": {
            "discovery": "INTERNAL"
          },
          "title": "beam_mcp: nested tool argument constraints advertised but not enforced",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eRe-validate the arguments inside the host\u0027s dispatch function against every constraint the schema declares below the top level, or move each constraint to a top-level property, which the affected versions do enforce.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Re-validate the arguments inside the host\u0027s dispatch function against every constraint the schema declares below the top level, or move each constraint to a top-level property, which the affected versions do enforce."
                }
              ],
              "value": "Re-validate the arguments inside the host\u0027s dispatch function against every constraint the schema declares below the top level, or move each constraint to a top-level property, which the affected versions do enforce."
            }
          ],
          "x_proofOfConcept": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003col\u003e\n\u003cli\u003eDeclare a tool whose \u003ccode\u003einput_schema\u003c/code\u003e has a nested object property \u003ccode\u003eopts\u003c/code\u003e with \u003ccode\u003e\"properties\": {\"level\": {\"type\": \"integer\", \"maximum\": 3}}\u003c/code\u003e, \u003ccode\u003e\"required\": [\"level\"]\u003c/code\u003e and \u003ccode\u003e\"additionalProperties\": false\u003c/code\u003e, and an array property \u003ccode\u003etags\u003c/code\u003e with \u003ccode\u003e\"items\": {\"type\": \"string\"}\u003c/code\u003e and \u003ccode\u003e\"maxItems\": 2\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003etools/call\u003c/code\u003e with \u003ccode\u003e\"arguments\": {\"opts\": {\"level\": 99, \"extra\": \"x\"}}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOn beam_mcp 0.10.0 the dispatch function receives \u003ccode\u003e%{opts: %{\"extra\" =\u0026gt; \"x\", \"level\" =\u0026gt; 99}}\u003c/code\u003e. On 0.10.1 the call is refused with \u003ccode\u003einvalid arguments: unknown property: opts.extra\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003e\"arguments\": {\"tags\": [1, 2, 3]}\u003c/code\u003e. On 0.10.0 the dispatch function receives \u003ccode\u003etags: [1, 2, 3]\u003c/code\u003e. On 0.10.1 the call is refused with \u003ccode\u003etags must have at most 2 items\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "1. Declare a tool whose `input_schema` has a nested object property `opts` with `\"properties\": {\"level\": {\"type\": \"integer\", \"maximum\": 3}}`, `\"required\": [\"level\"]` and `\"additionalProperties\": false`, and an array property `tags` with `\"items\": {\"type\": \"string\"}` and `\"maxItems\": 2`.\n2. Send `tools/call` with `\"arguments\": {\"opts\": {\"level\": 99, \"extra\": \"x\"}}`.\n3. On beam_mcp 0.10.0 the dispatch function receives `%{opts: %{\"extra\" =\u003e \"x\", \"level\" =\u003e 99}}`. On 0.10.1 the call is refused with `invalid arguments: unknown property: opts.extra`.\n4. Send `\"arguments\": {\"tags\": [1, 2, 3]}`. On 0.10.0 the dispatch function receives `tags: [1, 2, 3]`. On 0.10.1 the call is refused with `tags must have at most 2 items`."
                }
              ],
              "value": "* Declare a tool whose input_schema has a nested object property opts with \"properties\": {\"level\": {\"type\": \"integer\", \"maximum\": 3}}, \"required\": [\"level\"] and \"additionalProperties\": false, and an array property tags with \"items\": {\"type\": \"string\"} and \"maxItems\": 2.\n* Send tools/call with \"arguments\": {\"opts\": {\"level\": 99, \"extra\": \"x\"}}.\n* On beam_mcp 0.10.0 the dispatch function receives %{opts: %{\"extra\" =\u003e \"x\", \"level\" =\u003e 99}}. On 0.10.1 the call is refused with invalid arguments: unknown property: opts.extra.\n* Send \"arguments\": {\"tags\": [1, 2, 3]}. On 0.10.0 the dispatch function receives tags: [1, 2, 3]. On 0.10.1 the call is refused with tags must have at most 2 items."
            }
          ],
          "x_technicalAnalysis": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003e\u003cstrong\u003e1. Advertising.\u003c/strong\u003e \u003ccode\u003etools/list\u003c/code\u003e returns each tool\u0027s \u003ccode\u003einput_schema\u003c/code\u003e verbatim, including nested \u003ccode\u003eproperties\u003c/code\u003e, \u003ccode\u003eitems\u003c/code\u003e and constraint keywords.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Validation.\u003c/strong\u003e \u003ccode\u003eBeamMCP.Schema.validate/2\u003c/code\u003e in \u003ccode\u003elib/beam_mcp/schema.ex\u003c/code\u003e walks only the first level: \u003ccode\u003echeck_required/2\u003c/code\u003e and \u003ccode\u003echeck_additional/3\u003c/code\u003e run on the top-level object, and \u003ccode\u003echeck_properties/2\u003c/code\u003e applies \u003ccode\u003echeck_type\u003c/code\u003e, \u003ccode\u003echeck_enum\u003c/code\u003e and \u003ccode\u003echeck_range\u003c/code\u003e to each top-level value. A value of type \u003ccode\u003eobject\u003c/code\u003e or \u003ccode\u003earray\u003c/code\u003e is accepted once its own type matches, and its contents are not visited. Keywords the validator does not know are ignored.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Dispatch.\u003c/strong\u003e \u003ccode\u003eBeamMCP.Server.validate_and_dispatch/3\u003c/code\u003e passes the accepted arguments to \u003ccode\u003enormalize_arguments/2\u003c/code\u003e and then to the host\u0027s dispatch function, so an undeclared key inside a nested object, an out-of-range nested number, or an array item of the wrong type reaches host code that believed the schema excluded it. The same validator runs on \u003ccode\u003eprompts/get\u003c/code\u003e arguments. The fix in 0.10.1 enforces every keyword of the documented subset at every depth and refuses a schema that uses any other keyword when the catalog is loaded.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "**1. Advertising.** `tools/list` returns each tool\u0027s `input_schema` verbatim, including nested `properties`, `items` and constraint keywords.\n\n**2. Validation.** `BeamMCP.Schema.validate/2` in `lib/beam_mcp/schema.ex` walks only the first level: `check_required/2` and `check_additional/3` run on the top-level object, and `check_properties/2` applies `check_type`, `check_enum` and `check_range` to each top-level value. A value of type `object` or `array` is accepted once its own type matches, and its contents are not visited. Keywords the validator does not know are ignored.\n\n**3. Dispatch.** `BeamMCP.Server.validate_and_dispatch/3` passes the accepted arguments to `normalize_arguments/2` and then to the host\u0027s dispatch function, so an undeclared key inside a nested object, an out-of-range nested number, or an array item of the wrong type reaches host code that believed the schema excluded it. The same validator runs on `prompts/get` arguments. The fix in 0.10.1 enforces every keyword of the documented subset at every depth and refuses a schema that uses any other keyword when the catalog is loaded."
                }
              ],
              "value": "1. Advertising. tools/list returns each tool\u0027s input_schema verbatim, including nested properties, items and constraint keywords.\n\n2. Validation. BeamMCP.Schema.validate/2 in lib/beam_mcp/schema.ex walks only the first level: check_required/2 and check_additional/3 run on the top-level object, and check_properties/2 applies check_type, check_enum and check_range to each top-level value. A value of type object or array is accepted once its own type matches, and its contents are not visited. Keywords the validator does not know are ignored.\n\n3. Dispatch. BeamMCP.Server.validate_and_dispatch/3 passes the accepted arguments to normalize_arguments/2 and then to the host\u0027s dispatch function, so an undeclared key inside a nested object, an out-of-range nested number, or an array item of the wrong type reaches host code that believed the schema excluded it. The same validator runs on prompts/get arguments. The fix in 0.10.1 enforces every keyword of the documented subset at every depth and refuses a schema that uses any other keyword when the catalog is loaded."
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-88257",
        "datePublished": "2026-10-08T13:40:55.828Z",
        "dateReserved": "2026-10-07T22:15:01.878Z",
        "dateUpdated": "2026-10-08T14:09:41.540Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.