Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

deeptutor

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.7PyPIAmendedPublished

    DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools

    CVE-2026-58168 · GHSA-jg88-rvpc-qvxj

    Affected
    • PyPI deeptutor < 1.4.10
    Fixed in
    1.4.10· Vendor fix available
    Issue
    DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowedmcptools function returning None instead of a denied result when mcptools is omitted from a user's grant in deeptutor/multiuser/toolaccess.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources.

    Recommended action: Upgrade to 1.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →