deeptutor
DeepTutor core module
Activity
- Latest release
- 1d ago
- Total releases
- 52
- Cadence
- ~2 days
- Last 12 months
- 52
Details
- License
- Apache-2.0
- First release
- May 21, 2026
| Version | Released | |
|---|---|---|
1.7.0
minor
|
1.7.0
minor
Dependencies (69)
+ 61 more |
|
1.6.15
patch
|
1.6.15
patch
Dependencies (92)
+ 84 more |
|
1.6.14
patch
|
1.6.14
patch
Dependencies (88)
+ 80 more |
|
1.6.13
patch
|
1.6.13
patch
Dependencies (87)
+ 79 more |
|
1.6.12
patch
|
1.6.12
patch
Dependencies (87)
+ 79 more |
|
1.6.11
patch
|
1.6.11
patch
Dependencies (86)
+ 78 more |
|
1.6.10
patch
|
1.6.10
patch
Dependencies (86)
+ 78 more |
|
1.6.9
patch
|
1.6.9
patch
Dependencies (86)
+ 78 more |
|
1.6.8
patch
|
1.6.8
patch
Dependencies (86)
+ 78 more |
|
1.6.7
patch
|
1.6.7
patch
Dependencies (86)
+ 78 more |
|
1.6.6
patch
|
1.6.6
patch
Dependencies (86)
+ 78 more |
|
1.6.5
patch
|
1.6.5
patch
Dependencies (86)
+ 78 more |
|
1.6.4
patch
|
1.6.4
patch
Dependencies (86)
+ 78 more |
|
1.6.3
patch
|
1.6.3
patch
Dependencies (86)
+ 78 more |
|
1.6.2
patch
|
1.6.2
patch
Dependencies (82)
+ 74 more |
|
1.6.1
patch
|
1.6.1
patch
Dependencies (81)
+ 73 more |
|
1.6.0
minor
|
1.6.0
minor
Dependencies (80)
+ 72 more |
|
1.5.17
patch
|
1.5.17
patch
Dependencies (80)
+ 72 more |
|
1.5.16
patch
|
1.5.16
patch
Dependencies (80)
+ 72 more |
|
1.5.15
patch
|
1.5.15
patch
Dependencies (80)
+ 72 more |
|
1.5.14
patch
|
1.5.14
patch
Dependencies (79)
+ 71 more |
|
1.5.13
patch
|
1.5.13
patch
Dependencies (79)
+ 71 more |
|
1.5.12
patch
|
1.5.12
patch
Dependencies (79)
+ 71 more |
|
1.5.11
patch
|
1.5.11
patch
Dependencies (77)
+ 69 more |
|
1.5.10
patch
|
1.5.10
patch
Dependencies (76)
+ 68 more |
|
1.5.9
patch
|
1.5.9
patch
Dependencies (76)
+ 68 more |
|
1.5.8
patch
|
1.5.8
patch
Dependencies (76)
+ 68 more |
|
1.5.7
patch
|
1.5.7
patch
Dependencies (76)
+ 68 more |
|
1.5.6
patch
|
1.5.6
patch
Dependencies (76)
+ 68 more |
|
1.5.5
patch
|
1.5.5
patch
Dependencies (76)
+ 68 more |
|
1.5.4
patch
|
1.5.4
patch
Dependencies (76)
+ 68 more |
|
1.5.3
patch
|
1.5.3
patch
Dependencies (76)
+ 68 more |
|
1.5.2
patch
|
1.5.2
patch
Dependencies (76)
+ 68 more |
|
1.5.1
patch
|
1.5.1
patch
Dependencies (76)
+ 68 more |
|
1.5.0
minor
|
1.5.0
minor
Dependencies (76)
+ 68 more |
|
1.4.15
patch
|
1.4.15
patch
Dependencies (76)
+ 68 more |
|
1.4.14
patch
|
1.4.14
patch
Dependencies (76)
+ 68 more |
|
1.4.13
patch
|
1.4.13
patch
Dependencies (76)
+ 68 more |
|
1.4.12
patch
|
1.4.12
patch
Dependencies (76)
+ 68 more |
|
1.4.11
patch
|
1.4.11
patch
Dependencies (73)
+ 65 more |
|
1.4.10
patch
|
1.4.10
patch
Dependencies (73)
+ 65 more |
|
1.4.9
patch
1 CVE
CVE-2026-58168
PYSEC-2026-4206
GHSA-jg88-rvpc-qvxj
Oct 15, 2026
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
Critical
Network
Low
Low
None
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources. Affected versions
1.4.0
1.4.0b0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
Fixed in
1.4.10
References
Updated Oct 15, 2026 · Source: OSV.dev |
1.4.9
patch
Dependencies (73)
+ 65 more |
|
1.4.8
patch
1 CVE
CVE-2026-58168
PYSEC-2026-4206
GHSA-jg88-rvpc-qvxj
Oct 15, 2026
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
Critical
Network
Low
Low
None
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources. Affected versions
1.4.0
1.4.0b0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
Fixed in
1.4.10
References
Updated Oct 15, 2026 · Source: OSV.dev |
1.4.8
patch
Dependencies (73)
+ 65 more |
|
1.4.7
patch
1 CVE
CVE-2026-58168
PYSEC-2026-4206
GHSA-jg88-rvpc-qvxj
Oct 15, 2026
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
Critical
Network
Low
Low
None
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources. Affected versions
1.4.0
1.4.0b0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
Fixed in
1.4.10
References
Updated Oct 15, 2026 · Source: OSV.dev |
1.4.7
patch
Dependencies (73)
+ 65 more |
|
1.4.6
patch
1 CVE
CVE-2026-58168
PYSEC-2026-4206
GHSA-jg88-rvpc-qvxj
Oct 15, 2026
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
Critical
Network
Low
Low
None
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources. Affected versions
1.4.0
1.4.0b0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
Fixed in
1.4.10
References
Updated Oct 15, 2026 · Source: OSV.dev |
1.4.6
patch
Dependencies (72)
+ 64 more |
|
1.4.5
patch
1 CVE
CVE-2026-58168
PYSEC-2026-4206
GHSA-jg88-rvpc-qvxj
Oct 15, 2026
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
Critical
Network
Low
Low
None
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources. Affected versions
1.4.0
1.4.0b0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
Fixed in
1.4.10
References
Updated Oct 15, 2026 · Source: OSV.dev |
1.4.5
patch
Dependencies (68)
+ 60 more |
|
1.4.4
patch
1 CVE
CVE-2026-58168
PYSEC-2026-4206
GHSA-jg88-rvpc-qvxj
Oct 15, 2026
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
Critical
Network
Low
Low
None
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources. Affected versions
1.4.0
1.4.0b0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
Fixed in
1.4.10
References
Updated Oct 15, 2026 · Source: OSV.dev |
1.4.4
patch
Dependencies (68)
+ 60 more |
|
1.4.3
patch
1 CVE
CVE-2026-58168
PYSEC-2026-4206
GHSA-jg88-rvpc-qvxj
Oct 15, 2026
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
Critical
Network
Low
Low
None
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources. Affected versions
1.4.0
1.4.0b0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
Fixed in
1.4.10
References
Updated Oct 15, 2026 · Source: OSV.dev |
1.4.3
patch
Dependencies (68)
+ 60 more |
|
1.4.2
patch
1 CVE
CVE-2026-58168
PYSEC-2026-4206
GHSA-jg88-rvpc-qvxj
Oct 15, 2026
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
Critical
Network
Low
Low
None
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources. Affected versions
1.4.0
1.4.0b0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
Fixed in
1.4.10
References
Updated Oct 15, 2026 · Source: OSV.dev |
1.4.2
patch
Dependencies (65)
+ 57 more |
|
1.4.1
patch
1 CVE
CVE-2026-58168
PYSEC-2026-4206
GHSA-jg88-rvpc-qvxj
Oct 15, 2026
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
Critical
Network
Low
Low
None
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources. Affected versions
1.4.0
1.4.0b0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
Fixed in
1.4.10
References
Updated Oct 15, 2026 · Source: OSV.dev |
1.4.1
patch
Dependencies (65)
+ 57 more |