medium2026-11-10 CVE-2026-102943-Dagu MCP DAG specification read bypasses path containment and workspace isolation GHSA-5m6c-38r8-5w76