Skip to content
OpenAdvisories
High · 8.8 CVE-2026-9764 EUVD-2026-119740GHSA-j6v4-89vv-vhvx

IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution

Published Nov 8, 2026 · Updated Nov 9, 2026 · Assigned by ibm

Vendor: IBM Product: Bob Shell

Description

IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

Affected products

VendorProductAffectedFixed
IBM Bob Shell 1.0.4 – ≤ 2.0.1 —

References