CVE-2026-51912

CVSS 9.8 (critical) · published 2026-10-29

OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46).

Weakness: CWE-22

Source: NVD CVE-2026-51912

References

• https://gist.github.com/Ro1ME/9999d9e504c5238dc48a023ef7c51d01
• https://github.com/OpenBMB/XAgent

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.