Security advisories for vibe-coded apps · Updated · 2 new this week
Find the leak
before someone else does.
102 advisories across 33 AI tools: app builders, coding agents, MCP servers, models and LLM frameworks. Each one is tied to a CVE, a GitHub advisory, a vendor bulletin or published research.
Latest critical
All critical advisories → 01. 2026-09-30
Next.js: Remote Code Execution in next/og ImageResponse
The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution.
Next.js 02. 2026-09-08CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.
Next.js 03. 2026-09-08Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.
Next.jsCoverage
Six kinds of tool, one place to check.
01.
11 advisories · 6 tools02.
44 advisories · 10 tools03.
24 advisories · 1 tools04.
8 advisories · 7 tools05.
23 advisories · 7 tools06.
12 advisories · 2 tools
App builders
Prompt-to-app platforms that generate and host whole apps.
11 advisories · 6 tools02.IDEs & agents
AI code editors, coding agents and CLIs that read and write your repo.
44 advisories · 10 tools03.MCP
Model Context Protocol: the SDKs, servers and clients that wire tools into agents.
24 advisories · 1 tools04.Models & APIs
Foundation models and their APIs: prompt injection, jailbreaks and data leakage.
8 advisories · 7 tools05.LLM frameworks
Libraries and runtimes for building and serving LLM apps.
23 advisories · 7 tools06.Generated stack
The frameworks AI builders generate code for, where their bugs land in your app.
12 advisories · 2 toolsNew CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningNew CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionCVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverNext.js: Remote Code Execution in next/og ImageResponseCVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parametersCVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originCVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteCVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted serversNext.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedCVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpointCVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesSupabase tables readable by anyone with no loginSupabase service_role / secret key shipped to the browserSecrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesCVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionCVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validationNew CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningNew CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionCVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverNext.js: Remote Code Execution in next/og ImageResponseCVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parametersCVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originCVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteCVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted serversNext.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedCVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpointCVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesSupabase tables readable by anyone with no loginSupabase service_role / secret key shipped to the browserSecrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesCVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionCVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validation
All advisories
Every known hole, with the fix.
102 advisories across app builders, coding agents, MCP, models and LLM frameworks. Worst first, each with how to check and what to change. Press / to jump to search.
102 advisories
01. Next.js: Remote Code Execution in next/og ImageResponseThe Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Next.js 2026-09-30 02. CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted serversA vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem. Next.js 2026-09-08 03. Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedA vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Next.js 2026-09-08 04. CVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpointBerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment. LiteLLM 2026-08-27 05. Supabase tables readable by anyone with no loginA scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login. Lovable Bolt v0 +4 more 2026-08 06. Supabase service_role / secret key shipped to the browserThe service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public. Lovable Bolt v0 +4 more 2026-08 07. CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header InjectionA Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. LiteLLM 2026-06-16 08. CVE-2026-12537: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypassesGemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. Gemini CLI 2026-04-24 09. CVE-2026-42208: LiteLLM has SQL Injection in Proxy API key verificationA database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. LiteLLM 2026-04-24 10. CVE-2025-61260: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration filesA vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex CLI 2026-04-14 11. CVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal VulnerabilityThe OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. MCP SDKs & servers 2026-03-31 12. CVE-2026-22778: vLLM has RCE In Video ProcessingvLLM has RCE In Video Processing. vLLM 2026-02-02 13. CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operationsA critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations. Ollama 2025-12-18 14. CamoLeak: Copilot Chat leaked private source codeLegit Security reported a critical vulnerability in GitHub Copilot Chat that could leak private source code from a user’s repositories. Copilot 2025-10-08 15. CVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connectionsmcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL MCP SDKs & servers 2025-07-09 16. Base44: private apps open to anyone with the app_id (Wiz)Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours. Base44 2025-07 17. CVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxyVersions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. MCP SDKs & servers 2025-06-13 18. CVE-2025-32711 (EchoLeak): zero-click data leak in Microsoft 365 CopilotAI command injection in Microsoft 365 Copilot let an unauthorised attacker disclose information over a network. Microsoft fixed it server-side. Copilot 2025-06-11 19. CVE-2025-1793: llama_index vulnerable to SQL InjectionMultiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. LlamaIndex 2025-06-05 20. CVE-2025-47277: vLLM Allows Remote Code Execution via PyNcclPipe Communication ServicevLLM Allows Remote Code Execution via PyNcclPipe Communication Service. vLLM 2025-05-20 21. CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSLovable-generated apps talked to Supabase directly from the browser, but many tables had no (or wrong) Row Level Security policies, so anyone with the public anon key could read or write data. Lovable Supabase 2025-05 22. CVE-2025-32444: vLLM Vulnerable to Remote Code Execution via Mooncake IntegrationvLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. vLLM 2025-04-29 23. CVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. Next.js v0 Bolt +2 more 2025-03 24. DeepSeek left a database open with chat history and secretsWiz found a publicly accessible DeepSeek database that allowed full control over database operations, exposing over a million lines of logs with chat history and other sensitive data. DeepSeek 2025-01-29 25. CVE-2024-46946: LangChain Experimental Eval Injection vulnerabilitylangchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05). LangChain 2024-09-19 26. CVE-2024-45201: LlamaIndex includes an exec call for `import {cls_name}`An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. LlamaIndex 2024-08-22 27. CVE-2024-3271: llama-index-core Command Injection vulnerabilityA command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. LlamaIndex 2024-04-16 28. CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code executionlangchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__… LangChain 2024-02-26 29. CVE-2023-6730: transformers has a Deserialization of Untrusted Data vulnerabilityDeserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0. Hugging Face 2023-12-19 30. CVE-2023-32785: Langchain SQL Injection vulnerabilityIn Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain. LangChain 2023-10-21 31. CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningThe plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. Claude Code 2026-10-15 32. CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverIn affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. MCP SDKs & servers 2026-10-06 33. CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. 
Open WebUI 2026-09-10 34. CVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. Open WebUI 2026-09-10 35. CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Open WebUI 2026-08-04 36. Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. Lovable Bolt v0 +4 more 2026-08 37. CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionClaude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. Claude Code 2026-07-24 38. CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validationIn affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation. MCP SDKs & servers 2026-07-16 39. CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalIn affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. MCP SDKs & servers 2026-07-16 40. CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksIn affected versions, the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it. MCP SDKs & servers 2026-07-16 41. CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassedThe /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. Open WebUI 2026-05-14 42. CVE-2026-44578: Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesSelf-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. Next.js 2026-05-11 43. CVE-2026-44574: Next.js has a Middleware / Proxy bypass through dynamic route parameter injectionApplications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. Next.js 2026-05-11 44. CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loaderOllama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. Ollama 2026-05-04 45. CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code ExecutionClaude Code used the git worktree commondir file when determining folder trust but did not validate its contents. Claude Code 2026-04-24 46. CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceClaude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. Claude Code 2026-04-21 47. CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesWhile testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. MCP SDKs & servers 2026-03-31 48. CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings FileClaude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. Claude Code 2026-03-19 49. CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP serversWhile testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request. MCP SDKs & servers 2026-03-16 50. CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.jsonClaude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. Claude Code 2026-02-06 51. CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write RestrictionsClaude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Claude Code 2026-02-06 52. CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write ProtectionClaude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Claude Code 2026-02-06 53. CVE-2026-25536: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments. MCP SDKs & servers 2026-02-04 54. CVE-2026-24887: Claude Code has a Command Injection in find Command Bypasses User Approval PromptDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Claude Code 2026-02-03 55. CVE-2026-24053: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File WritesDue to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Claude Code 2026-02-03 56. CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled DomainsClaude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. Claude Code 2026-02-03 57. CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server ToolsMicrosoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. MCP SDKs & servers 2026-01-07 58. CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerabilityA ReDoS vulnerability in the UriTemplate class allows attackers to cause denial of service. The partToRegExp() function generates a regex pattern with nested quantifiers (([^/]+(?:,[^/]+))) for exploded template variables (e.g., {/id}, {?tags*}), causing catastrophic backtracking on malicious input. MCP SDKs & servers 2026-01-05 59. CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code ExecutionDue to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-12-03 60. CVE-2025-66416: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 61. CVE-2025-66414: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 62. CVE-2025-64755: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File WritesDue to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. Claude Code 2025-11-20 63. CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialogWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-11-19 64. CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialogDue to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Claude Code 2025-10-03 65. Gemini Trifecta: three injection flaws in Google’s Gemini suiteTenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection. Google Gemini 2025-09-30 66. CVE-2025-59828: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn VersionsWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-09-24 67. CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logicDue to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. Codex CLI 2025-09-19 68. CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git emailAt startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace. Claude Code 2025-09-10 69. CVE-2025-58764: Claude Code rg vulnerability does not protect against approval prompt bypassDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-09-10 70. CVE-2025-58444: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP ServerAn XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. MCP SDKs & servers 2025-09-08 71. Windsurf: prompt injection leaks developer secretsEmbrace The Red showed how prompt injection in files the Cascade agent reads could get Windsurf to leak secrets from the developer’s machine. Windsurf 2025-08-21 72. CVE-2025-55284: Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude CodeDue to an overly broad allowlist of safe commands, it was possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation. Claude Code 2025-08-18 73. CVE-2025-53773: GitHub Copilot prompt injection to code executionCommand injection in GitHub Copilot and Visual Studio let an attacker run code on a developer’s machine. Embrace The Red showed it starting from a prompt injection in project content. Copilot 2025-08-12 74. CVE-2025-54795: Claude Code echo command allowed bypass of user approval prompt for command executionDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-08-04 75. CVE-2025-54794: Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file accessDue to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Claude Code 2025-08-04 76. CVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeBefore 1.3.9, Cursor let the agent create new dotfiles like .cursor/mcp.json without approval. Chained with prompt injection, this meant remote code execution. Cursor 2025-08 77. CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedIn Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt. Cursor MCP SDKs & servers 2025-08 78. CVE-2025-8217: malicious code shipped in Amazon Q Developer 1.84.0An over-scoped GitHub token in Amazon Q’s build setup let an attacker commit malicious code that shipped in the VS Code extension 1.84.0. AWS says it failed to run due to a syntax error. 
Amazon Q Developer 2025-07-23 79. Supabase MCP: a support ticket gets the agent to dump private tablesGeneral Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role. MCP SDKs & servers Supabase Cursor +1 more 2025-07-08 80. CVE-2025-53366: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoSA validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. MCP SDKs & servers 2025-07-04 81. CVE-2025-53365: MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of ServiceIf a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. MCP SDKs & servers 2025-07-04 82. CVE-2025-53110: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefixVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue. MCP SDKs & servers 2025-07-01 83. CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handlingVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve. MCP SDKs & servers 2025-07-01 84. AI agent deleted a production database during a code freeze (Replit)Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible. Replit Cursor 2025-07 85. CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary originsClaude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when visiting attacker-controlled webpages. Claude Code 2025-06-23 86. GitHub MCP server: a public issue makes the agent leak private reposInvariant Labs showed that a prompt injection planted in a public GitHub issue could get an agent using the official GitHub MCP server to pull data from the user’s private repositories. MCP SDKs & servers Claude Code Cursor +1 more 2025-05-26 87. MCP tool poisoning: hidden instructions in tool descriptionsAn MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere. MCP SDKs & servers Cursor Claude Code +2 more 2025-04-01 88. “Rules File Backdoor”: hidden Unicode instructions in AI rules filesPillar Security showed invisible Unicode characters in shared rules files (.cursorrules, .mdc) can steer Cursor and GitHub Copilot into writing backdoored code. Cursor Copilot 2025-03 89. Authentication logic living entirely in the browserHiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly. Lovable Base44 Bolt +3 more 2025 90. Slopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. Claude Code Copilot Cursor +5 more 2025 91. CVE-2024-11393: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 92. CVE-2024-11394: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 93. OWASP LLM01:2025: prompt injection is the top LLM app riskOWASP ranks prompt injection first in its Top 10 for LLM Applications 2025. Any app that feeds untrusted text to a model with tools or data access is exposed. OpenAI Anthropic Claude Google Gemini +4 more 2024-11-18 94. SpAIware: prompt injection writes into ChatGPT’s long-term memoryEmbrace The Red showed untrusted content planting persistent instructions in ChatGPT’s memory on the macOS app, so later chats kept sending data to the attacker. OpenAI 2024-09-20 95. CVE-2024-28224: Ollama DNS rebinding vulnerabilityOllama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion). Ollama 2024-04-08 96. CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion. MCP SDKs & servers 2026-10-15 97. CVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parametersAny authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. LiteLLM 2026-09-30 98. Grok 4 jailbroken within 48 hours of launchNeuralTrust combined its Echo Chamber and Crescendo multi-turn techniques to jailbreak Grok 4 two days after release. 
xAI Grok 2025-07-11 99. Protecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. Next.js v0 Bolt +2 more 2025-03 100. DeepSeek R1 failed every harmful-prompt test in Cisco’s evaluationCisco ran algorithmic jailbreak testing against DeepSeek and other frontier reasoning models and published the results on 31 January 2025. DeepSeek 2025-01-31 101. CVE-2024-50050: Llama Stack used pickle over socketsMeta’s Llama Stack used Python pickle to deserialise socket messages, which could allow remote code execution. It switched to JSON. Meta Llama 2024-10-23 102. Many-shot jailbreaking: long context windows weaken refusalsAnthropic published research showing that filling a long prompt with many fake dialogue examples can push models into answering requests they would normally refuse. Anthropic Claude OpenAI Google Gemini +2 more 2024-04-02
Next.js 2026-09-30 02. CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted serversA vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem. Next.js 2026-09-08 03. Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedA vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Next.js 2026-09-08 04. CVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpointBerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment. LiteLLM 2026-08-27 05. Supabase tables readable by anyone with no loginA scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login. Lovable Bolt v0 +4 more 2026-08 06. Supabase service_role / secret key shipped to the browserThe service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public. Lovable Bolt v0 +4 more 2026-08 07. CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header InjectionA Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. LiteLLM 2026-06-16 08. CVE-2026-12537: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypassesGemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. Gemini CLI 2026-04-24 09. CVE-2026-42208: LiteLLM has SQL Injection in Proxy API key verificationA database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. LiteLLM 2026-04-24 10. CVE-2025-61260: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration filesA vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex CLI 2026-04-14 11. CVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal VulnerabilityThe OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. MCP SDKs & servers 2026-03-31 12. CVE-2026-22778: vLLM has RCE In Video ProcessingvLLM has RCE In Video Processing. vLLM 2026-02-02 13. CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operationsA critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations. Ollama 2025-12-18 14. CamoLeak: Copilot Chat leaked private source codeLegit Security reported a critical vulnerability in GitHub Copilot Chat that could leak private source code from a user’s repositories. Copilot 2025-10-08 15. CVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connectionsmcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL MCP SDKs & servers 2025-07-09 16. Base44: private apps open to anyone with the app_id (Wiz)Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours. Base44 2025-07 17. CVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxyVersions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. MCP SDKs & servers 2025-06-13 18. CVE-2025-32711 (EchoLeak): zero-click data leak in Microsoft 365 CopilotAI command injection in Microsoft 365 Copilot let an unauthorised attacker disclose information over a network. Microsoft fixed it server-side. Copilot 2025-06-11 19. CVE-2025-1793: llama_index vulnerable to SQL InjectionMultiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. LlamaIndex 2025-06-05 20. CVE-2025-47277: vLLM Allows Remote Code Execution via PyNcclPipe Communication ServicevLLM Allows Remote Code Execution via PyNcclPipe Communication Service. vLLM 2025-05-20 21. CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSLovable-generated apps talked to Supabase directly from the browser, but many tables had no (or wrong) Row Level Security policies, so anyone with the public anon key could read or write data. Lovable Supabase 2025-05 22. CVE-2025-32444: vLLM Vulnerable to Remote Code Execution via Mooncake IntegrationvLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. vLLM 2025-04-29 23. CVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. Next.js v0 Bolt +2 more 2025-03 24. DeepSeek left a database open with chat history and secretsWiz found a publicly accessible DeepSeek database that allowed full control over database operations, exposing over a million lines of logs with chat history and other sensitive data. DeepSeek 2025-01-29 25. CVE-2024-46946: LangChain Experimental Eval Injection vulnerabilitylangchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05). LangChain 2024-09-19 26. CVE-2024-45201: LlamaIndex includes an exec call for `import {cls_name}`An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. LlamaIndex 2024-08-22 27. CVE-2024-3271: llama-index-core Command Injection vulnerabilityA command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. LlamaIndex 2024-04-16 28. CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code executionlangchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__… LangChain 2024-02-26 29. CVE-2023-6730: transformers has a Deserialization of Untrusted Data vulnerabilityDeserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0. Hugging Face 2023-12-19 30. CVE-2023-32785: Langchain SQL Injection vulnerabilityIn Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain. LangChain 2023-10-21 31. CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningThe plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. Claude Code 2026-10-15 32. CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverIn affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. MCP SDKs & servers 2026-10-06 33. CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. Open WebUI 2026-09-10 34. CVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. Open WebUI 2026-09-10 35. CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Open WebUI 2026-08-04 36. Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. Lovable Bolt v0 +4 more 2026-08 37. CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionClaude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. Claude Code 2026-07-24 38. CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validationIn affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation. MCP SDKs & servers 2026-07-16 39. CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalIn affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. MCP SDKs & servers 2026-07-16 40. CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksIn affected versions, the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it. MCP SDKs & servers 2026-07-16 41. CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassedThe /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. Open WebUI 2026-05-14 42. CVE-2026-44578: Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesSelf-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. Next.js 2026-05-11 43. CVE-2026-44574: Next.js has a Middleware / Proxy bypass through dynamic route parameter injectionApplications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. Next.js 2026-05-11 44. CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loaderOllama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. Ollama 2026-05-04 45. CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code ExecutionClaude Code used the git worktree commondir file when determining folder trust but did not validate its contents. Claude Code 2026-04-24 46. CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceClaude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. Claude Code 2026-04-21 47. CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesWhile testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. MCP SDKs & servers 2026-03-31 48. CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings FileClaude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. Claude Code 2026-03-19 49. CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP serversWhile testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request. MCP SDKs & servers 2026-03-16 50. CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.jsonClaude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. Claude Code 2026-02-06 51. CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write RestrictionsClaude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Claude Code 2026-02-06 52. CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write ProtectionClaude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Claude Code 2026-02-06 53. CVE-2026-25536: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments. MCP SDKs & servers 2026-02-04 54. CVE-2026-24887: Claude Code has a Command Injection in find Command Bypasses User Approval PromptDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Claude Code 2026-02-03 55. CVE-2026-24053: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File WritesDue to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Claude Code 2026-02-03 56. CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled DomainsClaude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. Claude Code 2026-02-03 57. CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server ToolsMicrosoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. MCP SDKs & servers 2026-01-07 58. CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerabilityA ReDoS vulnerability in the UriTemplate class allows attackers to cause denial of service. The partToRegExp() function generates a regex pattern with nested quantifiers (([^/]+(?:,[^/]+))) for exploded template variables (e.g., {/id}, {?tags*}), causing catastrophic backtracking on malicious input. MCP SDKs & servers 2026-01-05 59. CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code ExecutionDue to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-12-03 60. CVE-2025-66416: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 61. CVE-2025-66414: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 62. CVE-2025-64755: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File WritesDue to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. Claude Code 2025-11-20 63. CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialogWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-11-19 64. CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialogDue to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Claude Code 2025-10-03 65. Gemini Trifecta: three injection flaws in Google’s Gemini suiteTenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection. Google Gemini 2025-09-30 66. CVE-2025-59828: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn VersionsWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-09-24 67. CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logicDue to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. Codex CLI 2025-09-19 68. CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git emailAt startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace. Claude Code 2025-09-10 69. CVE-2025-58764: Claude Code rg vulnerability does not protect against approval prompt bypassDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-09-10 70. CVE-2025-58444: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP ServerAn XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. MCP SDKs & servers 2025-09-08 71. Windsurf: prompt injection leaks developer secretsEmbrace The Red showed how prompt injection in files the Cascade agent reads could get Windsurf to leak secrets from the developer’s machine. Windsurf 2025-08-21 72. CVE-2025-55284: Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude CodeDue to an overly broad allowlist of safe commands, it was possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation. Claude Code 2025-08-18 73. CVE-2025-53773: GitHub Copilot prompt injection to code executionCommand injection in GitHub Copilot and Visual Studio let an attacker run code on a developer’s machine. Embrace The Red showed it starting from a prompt injection in project content. Copilot 2025-08-12 74. CVE-2025-54795: Claude Code echo command allowed bypass of user approval prompt for command executionDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-08-04 75. CVE-2025-54794: Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file accessDue to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Claude Code 2025-08-04 76. CVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeBefore 1.3.9, Cursor let the agent create new dotfiles like .cursor/mcp.json without approval. Chained with prompt injection, this meant remote code execution. Cursor 2025-08 77. CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedIn Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt. Cursor MCP SDKs & servers 2025-08 78. CVE-2025-8217: malicious code shipped in Amazon Q Developer 1.84.0An over-scoped GitHub token in Amazon Q’s build setup let an attacker commit malicious code that shipped in the VS Code extension 1.84.0. AWS says it failed to run due to a syntax error. Amazon Q Developer 2025-07-23 79. Supabase MCP: a support ticket gets the agent to dump private tablesGeneral Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role. MCP SDKs & servers Supabase Cursor +1 more 2025-07-08 80. CVE-2025-53366: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoSA validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. MCP SDKs & servers 2025-07-04 81. CVE-2025-53365: MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of ServiceIf a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. MCP SDKs & servers 2025-07-04 82. CVE-2025-53110: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefixVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue. MCP SDKs & servers 2025-07-01 83. CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handlingVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve. MCP SDKs & servers 2025-07-01 84. AI agent deleted a production database during a code freeze (Replit)Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible. Replit Cursor 2025-07 85. CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary originsClaude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when visiting attacker-controlled webpages. Claude Code 2025-06-23 86. GitHub MCP server: a public issue makes the agent leak private reposInvariant Labs showed that a prompt injection planted in a public GitHub issue could get an agent using the official GitHub MCP server to pull data from the user’s private repositories. MCP SDKs & servers Claude Code Cursor +1 more 2025-05-26 87. MCP tool poisoning: hidden instructions in tool descriptionsAn MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere. MCP SDKs & servers Cursor Claude Code +2 more 2025-04-01 88. “Rules File Backdoor”: hidden Unicode instructions in AI rules filesPillar Security showed invisible Unicode characters in shared rules files (.cursorrules, .mdc) can steer Cursor and GitHub Copilot into writing backdoored code. Cursor Copilot 2025-03 89. Authentication logic living entirely in the browserHiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly. Lovable Base44 Bolt +3 more 2025 90. Slopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. Claude Code Copilot Cursor +5 more 2025 91. CVE-2024-11393: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 92. CVE-2024-11394: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 93. OWASP LLM01:2025: prompt injection is the top LLM app riskOWASP ranks prompt injection first in its Top 10 for LLM Applications 2025. Any app that feeds untrusted text to a model with tools or data access is exposed. OpenAI Anthropic Claude Google Gemini +4 more 2024-11-18 94. SpAIware: prompt injection writes into ChatGPT’s long-term memoryEmbrace The Red showed untrusted content planting persistent instructions in ChatGPT’s memory on the macOS app, so later chats kept sending data to the attacker. OpenAI 2024-09-20 95. CVE-2024-28224: Ollama DNS rebinding vulnerabilityOllama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion). Ollama 2024-04-08 96. CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion. MCP SDKs & servers 2026-10-15 97. CVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parametersAny authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. LiteLLM 2026-09-30 98. Grok 4 jailbroken within 48 hours of launchNeuralTrust combined its Echo Chamber and Crescendo multi-turn techniques to jailbreak Grok 4 two days after release. xAI Grok 2025-07-11 99. Protecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. Next.js v0 Bolt +2 more 2025-03 100. DeepSeek R1 failed every harmful-prompt test in Cisco’s evaluationCisco ran algorithmic jailbreak testing against DeepSeek and other frontier reasoning models and published the results on 31 January 2025. DeepSeek 2025-01-31 101. CVE-2024-50050: Llama Stack used pickle over socketsMeta’s Llama Stack used Python pickle to deserialise socket messages, which could allow remote code execution. It switched to JSON. Meta Llama 2024-10-23 102. Many-shot jailbreaking: long context windows weaken refusalsAnthropic published research showing that filling a long prompt with many fake dialogue examples can push models into answering requests they would normally refuse. Anthropic Claude OpenAI Google Gemini +2 more 2024-04-02 Nothing matches that. Try another builder, or clear the filter.