fix: validate transport type in custom MCP server config to prevent command injection#4910

Open

jackieya wants to merge 1 commit into1Panel-dev:v2from

jackieya:fix/mcp-stdio-rce

Commits on Mar 20, 2026

fix: use ToolExecutor().validate_mcp_transport() to prevent MCP stdio command injection
jackieya
committed