adk web Took a CVSS 10 From a Denylist That Had profile but Not cProfile. Where Our Own Watch-or-Type Line Sits
This story is from 2026-09-10. It is preserved in the archive; the latest stories are on the live feed.
Google published GHSA-q9cv-5mjc-7cjc yesterday, CVE-2026-79696, against the Agent Development Kit for Python. Critical, CVSS 4.0 score of 10.0, weakness class CWE-184, "Incomplete List of Disallowed Inputs". The description: a code injection in adk web , versions 2.0.0 through 2.6.0, on plain Pytho…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-09-10 16:08 · DEV Community — AI
adk web Took a CVSS 10 From a Denylist That Had profile but Not cProfile. Where Our Own Watch-or-Type Line Sits