This week in code review: October 19 to 25, 2026
Three fixes from this week's advisories. Each one is a check that existed on one code path and was missing on another, or input that went into a query as text. All three were visible in a diff.
1. FastMCP checked the original component on a call by name, then ran the transformed one
Listing tools applied the server's transforms and then checked authorization. A direct lookup by name checked the original component and returned the transformed one without checking it again, so a transform that added an admin tag hid a tool from the list while a low-privilege caller could still call it by name.
The fix: Authorization now runs on the final, transformed component on the direct lookup path too.
In review: When a PR adds a second way to reach the same object, check that both ways run the same authorization on the same object.
Bug class: Missing authorization. Practise: Python PRs in the library.
Sources: GitHub advisory GHSA-7xgj-8392-5q4r · Fix PR #5933
2. LangGraph stores validated namespace labels in put but not in reads, deletes and batch writes
The Postgres and SQLite stores save a namespace as its labels joined with ., so the label tenant.bob and the two labels tenant, bob name the same stored namespace. put rejected labels containing a dot, but get, search, delete, list_namespaces and direct batch operations did not, so a caller could reach another namespace's items.
The fix: The same label check now runs at every entry point, through one shared helper called before any SQL.
In review: A validation that guards one method of a store usually belongs to all of them; look for the methods it skipped.
Bug class: IDOR (object-level authorization). Practise: How to spot IDOR · Python PRs in the library.
Sources: GitHub advisory GHSA-6hmw-9432-67qq · Fix PR #9217
3. mem0's Databricks vector store put memory text and metadata into SQL strings
insert() and update() in mem0/vector_stores/databricks.py built SQL by inserting values into the string, so memory text, metadata or a message name could carry SQL that ran on the configured Databricks warehouse.
The fix: Values are now bound as parameters (embedding vectors excepted), and in update() payload keys used as column names must match a strict identifier pattern.
In review: A value interpolated into query text is the comment to leave, even when it looks internal: here the values came from stored memories.
Bug class: SQL injection. Practise: How to spot SQL injection · Python PRs in the library.
Sources: GitHub advisory GHSA-7587-9684-52r6 · Fix PR #4558