Add INC-132..134 for the three CVE candidates triaged as relevant (#60, #81, #84)

[emmanuelgjr]

Closes the incident side of #60, #81 and #84 — the three CVEs the watcher surfaced and the last triage marked triage:relevant.

Provenance

Every field is transcribed from NVD and, where one exists, the vendor's own GitHub advisory. Severity is the published CVSS base severity, not a judgment of mine. Each control_failure quotes its source and leaves confirmed_by empty — drafted, not confirmed, as with the #87 batch.

	CVE	Source quality
INC-133 MCPHub	CVE-2026-79745	Maintainers' own advisory GHSA-6cvf-cfch-4g7m, fix in 1.0.32
INC-134 Headroom	CVE-2026-71416	Maintainers' own advisory GHSA-h46j-26q3-rggf, fix in 0.35.0
INC-132 Agno	CVE-2026-37003	Weaker — see below

The Agno record states its own limits

I nearly left this one out. Unlike the other two, it has no vendor advisory: the CNA is MITRE rather than the vendor, NVD lists the record Deferred, the CVSS 9.8 is a secondary third-party metric rather than an NVD or vendor score, and no fix release is named. The one substantive reference NVD carries beyond the CVE itself renders nothing to a fetcher, so I could not read it.

It is included because the CVE is published and states its mechanism, and the record says all of the above in its own description rather than presenting a 9.8 as though the vendor had confirmed it. If you would rather it waited for vendor confirmation, drop the record and the other two stand on their own.

What each says

• INC-132 — Agno ≤ 2.5.8: PythonTools and ShellTools pass unsanitised, LLM-generated arguments to exec(), runpy.run_path() and subprocess.run(); injection in content the agent reads reaches an execution sink. → LLM01, ASI02, ASI05.
• INC-133 — MCPHub < 1.0.32: mutating prompt/resource routes sit on the authenticated router "with no admin gate, and the handlers never read req.user", so any authenticated user can overwrite the templates every other session is served; the advisory names stored prompt injection as the downstream consequence. → ASI03, LLM01, ASI06.
• INC-134 — Headroom < 0.35.0: the WebSocket server "does not validate the Origin header … allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication", so a page in the victim's browser can spend their API key. → DSGAI02, LLM06.

One deliberate loose end

INC-134's NHI-4 failure is an orphan — neither DSGAI02 nor LLM06 maps NHI-4, so the evidence guard flags it and orphan_failures goes 0 → 1. NHI-4 Insecure Authentication is what the advisory describes; I first wrote NHI-2 and corrected it. Whether those entries should map NHI-4 is a mapping decision, so the warning stands rather than the control being swapped for one that happens to be mapped.

Verification

• All three CVEs re-checked live against the NVD API; both GHSAs read through the GitHub API, and the quoted sentences are verbatim.
• Incidents 131 → 134; drafted control failures 18 → 21, still 0 confirmed.
• node scripts/validate.js: 0 errors, 88 warnings (the +1 is the orphan above), 327 passed.
• npm run test:scripts: 85 passed. Stats and README marker current; generator reproduces.

🤖 Generated with Claude Code