Unverified50% confidenceDecision RuleExact time
For projects using Node.js or PHP, it is recommended to check dependency versions immediately to confirm whether they are affected by this RCE vulnerability.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/22/2026
First Seen
Valid until: 11/5/2026
Sources
Related Entities
Related Claims
UnverifiedAssessing the state of the dependency chain requires looking at the version constraints, update history and known vulnerability advisories of each dependency package, rather than merely confirming the core version number.70% similarUnverifiedEvery CVE identified by the tool has been cross-validated against the NVD or the GitHub Security Advisory database.67% similarUnverifiedIt is recommended that after upgrading you check whether the three upstream dependencies in the lockfile are updated together, confirm version alignment if the project directly references @ai-sdk/provider-utils, and run integration tests covering streaming responses and tool-call paths.66% similarUnverifiedDependency scanning tools partially rely on known vulnerability databases (such as CVE and OSV) for version comparison, and partially identify potentially malicious code by analyzing the dynamic behavioral characteristics of packages; the latter approach has a detection advantage over newly emerging counterfeit packages not yet in vulnerability databases.66% similarUnverifiedThe security scan statically analyzes the plugin's code and configuration and performs matching checks on network request targets.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1087230API
curl https://kongchang.com/api/v1/knowledge/claims/1087230MCP
get_claim(id=1087230)