All vulnerabilities

CVE-2026-NONE · GHSA-m78m-g6g8-4455

stockbit-mcp: caller-supplied confirm boolean bypasses MCP Elicitation confirmation on order-entry tools

highCVSS 7.1CWE-862

Vendor

INo-xious

Package

stockbit-mcp npm

Affected

<= 1.0.1

Disclosed

2026-08-28

Credit

Avishai Gonen

auth-bypassmcpprompt-injection

Published advisory