{ "version": 1, "generated": "2026-10-16T03:06:32.594Z", "count": 97, "items": [ { "id": "cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass", "url": "https://vibevulns.pages.dev/issues/cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass/", "title": "CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-10-15", "type": "access-control", "cve": "CVE-2026-86063", "ghsa": "GHSA-pq7j-f95f-qfcv", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA.", "sources": [ { "title": "GitHub Security Advisory GHSA-pq7j-f95f-qfcv", "url": "https://github.com/advisories/GHSA-pq7j-f95f-qfcv" }, { "title": "NVD: CVE-2026-86063", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86063" } ] }, { "id": "cve-2026-104850-mcp-typescript-sdk-oauth-client-could-send", "url": "https://vibevulns.pages.dev/issues/cve-2026-104850-mcp-typescript-sdk-oauth-client-could-send/", "title": "CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 7.5)", "date": "2026-10-06", "type": "secrets", "cve": "CVE-2026-104850", "ghsa": "GHSA-6qxp-vccf-f47h", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to.", "sources": [ { "title": "GitHub Security Advisory GHSA-6qxp-vccf-f47h", "url": "https://github.com/advisories/GHSA-6qxp-vccf-f47h" }, { "title": "NVD: CVE-2026-104850", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104850" } ] }, { "id": "cve-2026-87995-open-webui-same-origin-xss-to-account-takeover", "url": "https://vibevulns.pages.dev/issues/cve-2026-87995-open-webui-same-origin-xss-to-account-takeover/", "title": "CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.7)", "date": "2026-09-10", "type": "secrets", "cve": "CVE-2026-87995", "ghsa": "GHSA-jmc6-2wr8-h3wj", "tools": [ "open-webui" ], "categories": [ "frameworks" ], "summary": "Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself.", "sources": [ { "title": "GitHub Security Advisory GHSA-jmc6-2wr8-h3wj", "url": "https://github.com/advisories/GHSA-jmc6-2wr8-h3wj" }, { "title": "NVD: CVE-2026-87995", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87995" } ] }, { "id": "cve-2026-75604-next-js-unauthenticated-remote-code-execution-on", "url": "https://vibevulns.pages.dev/issues/cve-2026-75604-next-js-unauthenticated-remote-code-execution-on/", "title": "CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9)", "date": "2026-09-08", "type": "rce", "cve": "CVE-2026-75604", "ghsa": "GHSA-p293-qw3h-jr36", "tools": [ "nextjs" ], "categories": [ "stack" ], "summary": "A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.", "sources": [ { "title": "GitHub Security Advisory GHSA-p293-qw3h-jr36", "url": "https://github.com/advisories/GHSA-p293-qw3h-jr36" }, { "title": "NVD: CVE-2026-75604", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75604" } ] }, { "id": "cve-2026-37004-litellm-vulnerable-to-server-side-template", "url": "https://vibevulns.pages.dev/issues/cve-2026-37004-litellm-vulnerable-to-server-side-template/", "title": "CVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2026-08-27", "type": "access-control", "cve": "CVE-2026-37004", "ghsa": "GHSA-6wvf-77m9-58rm", "tools": [ "litellm" ], "categories": [ "frameworks" ], "summary": "BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.", "sources": [ { "title": "GitHub Security Advisory GHSA-6wvf-77m9-58rm", "url": "https://github.com/advisories/GHSA-6wvf-77m9-58rm" }, { "title": "NVD: CVE-2026-37004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37004" } ] }, { "id": "cve-2026-70492-open-webui-stored-xss-via-unescaped-katex-render", "url": "https://vibevulns.pages.dev/issues/cve-2026-70492-open-webui-stored-xss-via-unescaped-katex-render/", "title": "CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.7)", "date": "2026-08-04", "type": "access-control", "cve": "CVE-2026-70492", "ghsa": "GHSA-pwxh-7358-jq2x", "tools": [ "open-webui" ], "categories": [ "frameworks" ], "summary": "Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error.", "sources": [ { "title": "GitHub Security Advisory GHSA-pwxh-7358-jq2x", "url": "https://github.com/advisories/GHSA-pwxh-7358-jq2x" }, { "title": "NVD: CVE-2026-70492", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70492" } ] }, { "id": "supabase-tables-readable-without-login", "url": "https://vibevulns.pages.dev/issues/supabase-tables-readable-without-login/", "title": "Supabase tables readable by anyone with no login", "severity": "critical", "severity_basis": "VibeVulns rating: users/orders data exposed to unauthenticated requests", "date": "2026-08", "type": "access-control", "cve": null, "ghsa": null, "tools": [ "lovable", "bolt", "v0", "replit", "base44", "supabase", "cursor" ], "categories": [ "builders", "stack", "agents" ], "summary": "A scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login.", "sources": [ { "title": "r/vibecoding: I scanned 30,998 live vibe-coded apps", "url": "https://www.reddit.com/r/vibecoding/comments/1w68ce4/i_scanned_30998_live_vibecoded_apps_from_the/" }, { "title": "Escape: State of Security of Vibe Coded Apps 2025 (PDF)", "url": "https://26857953.fs1.hubspotusercontent-eu1.net/hubfs/26857953/State-Security-Vibe%20Coded%20Apps%20Report%202025%20Escape.pdf" }, { "title": "Supabase docs: Securing your data", "url": "https://supabase.com/docs/guides/database/secure-data" } ] }, { "id": "supabase-service-role-key-in-frontend", "url": "https://vibevulns.pages.dev/issues/supabase-service-role-key-in-frontend/", "title": "Supabase service_role / secret key shipped to the browser", "severity": "critical", "severity_basis": "VibeVulns rating: key bypasses all RLS (Supabase docs)", "date": "2026-08", "type": "secrets", "cve": null, "ghsa": null, "tools": [ "lovable", "bolt", "v0", "replit", "base44", "supabase", "cursor" ], "categories": [ "builders", "stack", "agents" ], "summary": "The service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public.", "sources": [ { "title": "Supabase docs: Securing your data", "url": "https://supabase.com/docs/guides/database/secure-data" }, { "title": "Supabase docs: API keys", "url": "https://supabase.com/docs/guides/getting-started/api-keys" }, { "title": "r/vibecoding: 30,998-app scan", "url": "https://www.reddit.com/r/vibecoding/comments/1w68ce4/i_scanned_30998_live_vibecoded_apps_from_the/" } ] }, { "id": "next-public-env-secret-leak", "url": "https://vibevulns.pages.dev/issues/next-public-env-secret-leak/", "title": "Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variables", "severity": "high", "severity_basis": "VibeVulns rating: exposes paid API keys (OpenAI, Stripe, AWS)", "date": "2026-08", "type": "secrets", "cve": null, "ghsa": null, "tools": [ "lovable", "bolt", "v0", "replit", "base44", "nextjs", "cursor" ], "categories": [ "builders", "stack", "agents" ], "summary": "Prefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way.", "sources": [ { "title": "KeyDrift: Supabase JWT exposed in a Next.js app", "url": "https://keydrift.dev/fix/supabase-service-role-exposed-in-nextjs" }, { "title": "r/vibecoding: 30,998-app scan", "url": "https://www.reddit.com/r/vibecoding/comments/1w68ce4/i_scanned_30998_live_vibecoded_apps_from_the/" }, { "title": "Escape: State of Security of Vibe Coded Apps 2025 (PDF)", "url": "https://26857953.fs1.hubspotusercontent-eu1.net/hubfs/26857953/State-Security-Vibe%20Coded%20Apps%20Report%202025%20Escape.pdf" } ] }, { "id": "cve-2026-55607-claude-code-sandbox-escape-via-git-worktree-path", "url": "https://vibevulns.pages.dev/issues/cve-2026-55607-claude-code-sandbox-escape-via-git-worktree-path/", "title": "CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-07-24", "type": "prompt-injection", "cve": "CVE-2026-55607", "ghsa": "GHSA-7835-87q9-rgvv", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code's worktree handling allowed creation of worktrees named \".git\" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks.", "sources": [ { "title": "GitHub Security Advisory GHSA-7835-87q9-rgvv", "url": "https://github.com/advisories/GHSA-7835-87q9-rgvv" }, { "title": "NVD: CVE-2026-55607", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55607" } ] }, { "id": "cve-2026-59950-mcp-python-sdk-websocket-server-transport-does", "url": "https://vibevulns.pages.dev/issues/cve-2026-59950-mcp-python-sdk-websocket-server-transport-does/", "title": "CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validation", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-07-16", "type": "access-control", "cve": "CVE-2026-59950", "ghsa": "GHSA-vj7q-gjh5-988w", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "In affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation.", "sources": [ { "title": "GitHub Security Advisory GHSA-vj7q-gjh5-988w", "url": "https://github.com/advisories/GHSA-vj7q-gjh5-988w" }, { "title": "NVD: CVE-2026-59950", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59950" } ] }, { "id": "cve-2026-52869-mcp-python-sdk-http-transports-serve-session", "url": "https://vibevulns.pages.dev/issues/cve-2026-52869-mcp-python-sdk-http-transports-serve-session/", "title": "CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 7.1)", "date": "2026-07-16", "type": "secrets", "cve": "CVE-2026-52869", "ghsa": "GHSA-jpw9-pfvf-9f58", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session.", "sources": [ { "title": "GitHub Security Advisory GHSA-jpw9-pfvf-9f58", "url": "https://github.com/advisories/GHSA-jpw9-pfvf-9f58" }, { "title": "NVD: CVE-2026-52869", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52869" } ] }, { "id": "cve-2026-52870-mcp-python-sdk-experimental-task-handlers-allow", "url": "https://vibevulns.pages.dev/issues/cve-2026-52870-mcp-python-sdk-experimental-task-handlers-allow/", "title": "CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 7.6)", "date": "2026-07-16", "type": "access-control", "cve": "CVE-2026-52870", "ghsa": "GHSA-hvrp-rf83-w775", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "In affected versions, the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it.", "sources": [ { "title": "GitHub Security Advisory GHSA-hvrp-rf83-w775", "url": "https://github.com/advisories/GHSA-hvrp-rf83-w775" }, { "title": "NVD: CVE-2026-52870", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52870" } ] }, { "id": "cve-2026-49468-litellm-authentication-bypass-via-host-header", "url": "https://vibevulns.pages.dev/issues/cve-2026-49468-litellm-authentication-bypass-via-host-header/", "title": "CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header Injection", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2026-06-16", "type": "access-control", "cve": "CVE-2026-49468", "ghsa": "GHSA-4xpc-pv4p-pm3w", "tools": [ "litellm" ], "categories": [ "frameworks" ], "summary": "A Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes.", "sources": [ { "title": "GitHub Security Advisory GHSA-4xpc-pv4p-pm3w", "url": "https://github.com/advisories/GHSA-4xpc-pv4p-pm3w" }, { "title": "NVD: CVE-2026-49468", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49468" } ] }, { "id": "cve-2026-45672-open-webui-jupyter-code-execution-works-despite", "url": "https://vibevulns.pages.dev/issues/cve-2026-45672-open-webui-jupyter-code-execution-works-despite/", "title": "CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.8)", "date": "2026-05-14", "type": "rce", "cve": "CVE-2026-45672", "ghsa": "GHSA-482j-2pq6-q5w4", "tools": [ "open-webui" ], "categories": [ "frameworks" ], "summary": "The /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says \"disabled\" but code still executes.", "sources": [ { "title": "GitHub Security Advisory GHSA-482j-2pq6-q5w4", "url": "https://github.com/advisories/GHSA-482j-2pq6-q5w4" }, { "title": "NVD: CVE-2026-45672", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45672" } ] }, { "id": "cve-2026-44578-next-js-vulnerable-to-server-side-request-forgery", "url": "https://vibevulns.pages.dev/issues/cve-2026-44578-next-js-vulnerable-to-server-side-request-forgery/", "title": "CVE-2026-44578: Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.6)", "date": "2026-05-11", "type": "ssrf", "cve": "CVE-2026-44578", "ghsa": "GHSA-c4j6-fc7j-m34r", "tools": [ "nextjs" ], "categories": [ "stack" ], "summary": "Self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests.", "sources": [ { "title": "GitHub Security Advisory GHSA-c4j6-fc7j-m34r", "url": "https://github.com/advisories/GHSA-c4j6-fc7j-m34r" }, { "title": "NVD: CVE-2026-44578", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44578" } ] }, { "id": "cve-2026-44574-next-js-has-a-middleware-proxy-bypass-through", "url": "https://vibevulns.pages.dev/issues/cve-2026-44574-next-js-has-a-middleware-proxy-bypass-through/", "title": "CVE-2026-44574: Next.js has a Middleware / Proxy bypass through dynamic route parameter injection", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.1)", "date": "2026-05-11", "type": "access-control", "cve": "CVE-2026-44574", "ghsa": "GHSA-492v-c6pp-mqqv", "tools": [ "nextjs" ], "categories": [ "stack" ], "summary": "Applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass.", "sources": [ { "title": "GitHub Security Advisory GHSA-492v-c6pp-mqqv", "url": "https://github.com/advisories/GHSA-492v-c6pp-mqqv" }, { "title": "NVD: CVE-2026-44574", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44574" } ] }, { "id": "cve-2026-7482-ollama-contains-a-heap-out-of-bounds-read", "url": "https://vibevulns.pages.dev/issues/cve-2026-7482-ollama-contains-a-heap-out-of-bounds-read/", "title": "CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 9.1)", "date": "2026-05-04", "type": "secrets", "cve": "CVE-2026-7482", "ghsa": "GHSA-x8qc-fggm-mpqg", "tools": [ "ollama" ], "categories": [ "frameworks" ], "summary": "Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader.", "sources": [ { "title": "GitHub Security Advisory GHSA-x8qc-fggm-mpqg", "url": "https://github.com/advisories/GHSA-x8qc-fggm-mpqg" }, { "title": "NVD: CVE-2026-7482", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7482" } ] }, { "id": "cve-2026-12537-gemini-cli-remote-code-execution-via-workspace", "url": "https://vibevulns.pages.dev/issues/cve-2026-12537-gemini-cli-remote-code-execution-via-workspace/", "title": "CVE-2026-12537: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 10)", "date": "2026-04-24", "type": "rce", "cve": "CVE-2026-12537", "ghsa": "GHSA-wpqr-6v78-jr5g", "tools": [ "gemini-cli" ], "categories": [ "agents" ], "summary": "Gemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions.", "sources": [ { "title": "GitHub Security Advisory GHSA-wpqr-6v78-jr5g", "url": "https://github.com/advisories/GHSA-wpqr-6v78-jr5g" }, { "title": "NVD: CVE-2026-12537", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12537" } ] }, { "id": "cve-2026-42208-litellm-has-sql-injection-in-proxy-api-key", "url": "https://vibevulns.pages.dev/issues/cve-2026-42208-litellm-has-sql-injection-in-proxy-api-key/", "title": "CVE-2026-42208: LiteLLM has SQL Injection in Proxy API key verification", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2026-04-24", "type": "secrets", "cve": "CVE-2026-42208", "ghsa": "GHSA-r75f-5x8p-qvmc", "tools": [ "litellm" ], "categories": [ "frameworks" ], "summary": "A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter.", "sources": [ { "title": "GitHub Security Advisory GHSA-r75f-5x8p-qvmc", "url": "https://github.com/advisories/GHSA-r75f-5x8p-qvmc" }, { "title": "NVD: CVE-2026-42208", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42208" } ] }, { "id": "cve-2026-40068-claude-code-trust-dialog-bypass-via-git-worktree", "url": "https://vibevulns.pages.dev/issues/cve-2026-40068-claude-code-trust-dialog-bypass-via-git-worktree/", "title": "CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-04-24", "type": "rce", "cve": "CVE-2026-40068", "ghsa": "GHSA-q5hj-mxqh-vv77", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code used the git worktree commondir file when determining folder trust but did not validate its contents.", "sources": [ { "title": "GitHub Security Advisory GHSA-q5hj-mxqh-vv77", "url": "https://github.com/advisories/GHSA-q5hj-mxqh-vv77" }, { "title": "NVD: CVE-2026-40068", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40068" } ] }, { "id": "cve-2026-39861-claude-code-sandbox-escape-via-symlink-following", "url": "https://vibevulns.pages.dev/issues/cve-2026-39861-claude-code-sandbox-escape-via-symlink-following/", "title": "CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 10)", "date": "2026-04-21", "type": "prompt-injection", "cve": "CVE-2026-39861", "ghsa": "GHSA-vp62-r36r-9xqp", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace.", "sources": [ { "title": "GitHub Security Advisory GHSA-vp62-r36r-9xqp", "url": "https://github.com/advisories/GHSA-vp62-r36r-9xqp" }, { "title": "NVD: CVE-2026-39861", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39861" } ] }, { "id": "cve-2025-61260-openai-codex-cli-enables-code-execution-through", "url": "https://vibevulns.pages.dev/issues/cve-2025-61260-openai-codex-cli-enables-code-execution-through/", "title": "CVE-2025-61260: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2026-04-14", "type": "rce", "cve": "CVE-2025-61260", "ghsa": "GHSA-xrxf-jgv3-qmrm", "tools": [ "codex" ], "categories": [ "agents" ], "summary": "A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository.", "sources": [ { "title": "GitHub Security Advisory GHSA-xrxf-jgv3-qmrm", "url": "https://github.com/advisories/GHSA-xrxf-jgv3-qmrm" }, { "title": "NVD: CVE-2025-61260", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61260" } ] }, { "id": "cve-2026-32871-fastmcp-openapi-provider-has-an-ssrf-path", "url": "https://vibevulns.pages.dev/issues/cve-2026-32871-fastmcp-openapi-provider-has-an-ssrf-path/", "title": "CVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 10)", "date": "2026-03-31", "type": "ssrf", "cve": "CVE-2026-32871", "ghsa": "GHSA-vv7q-7jx5-f767", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "The OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service.", "sources": [ { "title": "GitHub Security Advisory GHSA-vv7q-7jx5-f767", "url": "https://github.com/advisories/GHSA-vv7q-7jx5-f767" }, { "title": "NVD: CVE-2026-32871", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32871" } ] }, { "id": "cve-2026-27124-fastmcp-missing-consent-verification-in-oauth", "url": "https://vibevulns.pages.dev/issues/cve-2026-27124-fastmcp-missing-consent-verification-in-oauth/", "title": "CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-03-31", "type": "access-control", "cve": "CVE-2026-27124", "ghsa": "GHSA-rww4-4w9c-7733", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "While testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub.", "sources": [ { "title": "GitHub Security Advisory GHSA-rww4-4w9c-7733", "url": "https://github.com/advisories/GHSA-rww4-4w9c-7733" }, { "title": "NVD: CVE-2026-27124", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27124" } ] }, { "id": "cve-2026-33068-claude-code-has-a-workspace-trust-dialog-bypass", "url": "https://vibevulns.pages.dev/issues/cve-2026-33068-claude-code-has-a-workspace-trust-dialog-bypass/", "title": "CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-03-19", "type": "rce", "cve": "CVE-2026-33068", "ghsa": "GHSA-mmgp-wc2j-qcv7", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog.", "sources": [ { "title": "GitHub Security Advisory GHSA-mmgp-wc2j-qcv7", "url": "https://github.com/advisories/GHSA-mmgp-wc2j-qcv7" }, { "title": "NVD: CVE-2026-33068", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33068" } ] }, { "id": "cve-2025-69196-fastmcp-oauth-proxy-token-reuse-across-mcp", "url": "https://vibevulns.pages.dev/issues/cve-2025-69196-fastmcp-oauth-proxy-token-reuse-across-mcp/", "title": "CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP servers", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-03-16", "type": "secrets", "cve": "CVE-2025-69196", "ghsa": "GHSA-5h2m-4q8j-pqpj", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "While testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request.", "sources": [ { "title": "GitHub Security Advisory GHSA-5h2m-4q8j-pqpj", "url": "https://github.com/advisories/GHSA-5h2m-4q8j-pqpj" }, { "title": "NVD: CVE-2025-69196", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69196" } ] }, { "id": "cve-2026-25725-claude-code-has-sandbox-escape-via-persistent", "url": "https://vibevulns.pages.dev/issues/cve-2026-25725-claude-code-has-sandbox-escape-via-persistent/", "title": "CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-02-06", "type": "rce", "cve": "CVE-2026-25725", "ghsa": "GHSA-ff64-7w26-62rf", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup.", "sources": [ { "title": "GitHub Security Advisory GHSA-ff64-7w26-62rf", "url": "https://github.com/advisories/GHSA-ff64-7w26-62rf" }, { "title": "NVD: CVE-2026-25725", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25725" } ] }, { "id": "cve-2026-25723-claude-code-vulnerable-to-command-injection-via", "url": "https://vibevulns.pages.dev/issues/cve-2026-25723-claude-code-vulnerable-to-command-injection-via/", "title": "CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-02-06", "type": "rce", "cve": "CVE-2026-25723", "ghsa": "GHSA-mhg7-666j-cqg4", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope.", "sources": [ { "title": "GitHub Security Advisory GHSA-mhg7-666j-cqg4", "url": "https://github.com/advisories/GHSA-mhg7-666j-cqg4" }, { "title": "NVD: CVE-2026-25723", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25723" } ] }, { "id": "cve-2026-25722-claude-code-vulnerable-to-command-injection-via", "url": "https://vibevulns.pages.dev/issues/cve-2026-25722-claude-code-vulnerable-to-command-injection-via/", "title": "CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-02-06", "type": "rce", "cve": "CVE-2026-25722", "ghsa": "GHSA-66q4-vfjg-2qhh", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation.", "sources": [ { "title": "GitHub Security Advisory GHSA-66q4-vfjg-2qhh", "url": "https://github.com/advisories/GHSA-66q4-vfjg-2qhh" }, { "title": "NVD: CVE-2026-25722", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25722" } ] }, { "id": "cve-2026-25536-modelcontextprotocol-sdk-has-cross-client-data", "url": "https://vibevulns.pages.dev/issues/cve-2026-25536-modelcontextprotocol-sdk-has-cross-client-data/", "title": "CVE-2026-25536: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 7.1)", "date": "2026-02-04", "type": "data-leak", "cve": "CVE-2026-25536", "ghsa": "GHSA-345p-7cg4-v4c7", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "Cross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments.", "sources": [ { "title": "GitHub Security Advisory GHSA-345p-7cg4-v4c7", "url": "https://github.com/advisories/GHSA-345p-7cg4-v4c7" }, { "title": "NVD: CVE-2026-25536", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25536" } ] }, { "id": "cve-2026-24887-claude-code-has-a-command-injection-in-find", "url": "https://vibevulns.pages.dev/issues/cve-2026-24887-claude-code-has-a-command-injection-in-find/", "title": "CVE-2026-24887: Claude Code has a Command Injection in find Command Bypasses User Approval Prompt", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-02-03", "type": "rce", "cve": "CVE-2026-24887", "ghsa": "GHSA-qgqw-h4xq-7w8w", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window.", "sources": [ { "title": "GitHub Security Advisory GHSA-qgqw-h4xq-7w8w", "url": "https://github.com/advisories/GHSA-qgqw-h4xq-7w8w" }, { "title": "NVD: CVE-2026-24887", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24887" } ] }, { "id": "cve-2026-24053-claude-code-has-a-path-restriction-bypass-via-zsh", "url": "https://vibevulns.pages.dev/issues/cve-2026-24053-claude-code-has-a-path-restriction-bypass-via-zsh/", "title": "CVE-2026-24053: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-02-03", "type": "access-control", "cve": "CVE-2026-24053", "ghsa": "GHSA-q728-gf8j-w49r", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts.", "sources": [ { "title": "GitHub Security Advisory GHSA-q728-gf8j-w49r", "url": "https://github.com/advisories/GHSA-q728-gf8j-w49r" }, { "title": "NVD: CVE-2026-24053", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24053" } ] }, { "id": "cve-2026-24052-claude-code-has-a-domain-validation-bypass-which", "url": "https://vibevulns.pages.dev/issues/cve-2026-24052-claude-code-has-a-domain-validation-bypass-which/", "title": "CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-02-03", "type": "data-leak", "cve": "CVE-2026-24052", "ghsa": "GHSA-vhw5-3g5m-8ggf", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests.", "sources": [ { "title": "GitHub Security Advisory GHSA-vhw5-3g5m-8ggf", "url": "https://github.com/advisories/GHSA-vhw5-3g5m-8ggf" }, { "title": "NVD: CVE-2026-24052", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24052" } ] }, { "id": "cve-2026-22778-vllm-has-rce-in-video", "url": "https://vibevulns.pages.dev/issues/cve-2026-22778-vllm-has-rce-in-video/", "title": "CVE-2026-22778: vLLM has RCE In Video Processing", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2026-02-02", "type": "rce", "cve": "CVE-2026-22778", "ghsa": "GHSA-4r2x-xpjr-7cvv", "tools": [ "vllm" ], "categories": [ "frameworks" ], "summary": "vLLM has RCE In Video Processing.", "sources": [ { "title": "GitHub Security Advisory GHSA-4r2x-xpjr-7cvv", "url": "https://github.com/advisories/GHSA-4r2x-xpjr-7cvv" }, { "title": "NVD: CVE-2026-22778", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22778" } ] }, { "id": "cve-2025-9611-microsoft-playwright-mcp-server-vulnerable-to-dns", "url": "https://vibevulns.pages.dev/issues/cve-2025-9611-microsoft-playwright-mcp-server-vulnerable-to-dns/", "title": "CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-01-07", "type": "ssrf", "cve": "CVE-2025-9611", "ghsa": "GHSA-6fg3-hvw7-2fwq", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections.", "sources": [ { "title": "GitHub Security Advisory GHSA-6fg3-hvw7-2fwq", "url": "https://github.com/advisories/GHSA-6fg3-hvw7-2fwq" }, { "title": "NVD: CVE-2025-9611", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9611" } ] }, { "id": "cve-2026-0621-anthropic-s-mcp-typescript-sdk-has-a-redos", "url": "https://vibevulns.pages.dev/issues/cve-2026-0621-anthropic-s-mcp-typescript-sdk-has-a-redos/", "title": "CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-01-05", "type": "dos", "cve": "CVE-2026-0621", "ghsa": "GHSA-8r9q-7v3j-jr4g", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "A ReDoS vulnerability in the UriTemplate class allows attackers to cause denial of service. The partToRegExp() function generates a regex pattern with nested quantifiers (([^/]+(?:,[^/]+))) for exploded template variables (e.g., {/id}, {?tags*}), causing catastrophic backtracking on malicious input.", "sources": [ { "title": "GitHub Security Advisory GHSA-8r9q-7v3j-jr4g", "url": "https://github.com/advisories/GHSA-8r9q-7v3j-jr4g" }, { "title": "NVD: CVE-2026-0621", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0621" } ] }, { "id": "cve-2025-63389-ollama-platform-has-missing-authentication", "url": "https://vibevulns.pages.dev/issues/cve-2025-63389-ollama-platform-has-missing-authentication/", "title": "CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operations", "severity": "critical", "severity_basis": "GitHub advisory severity: critical", "date": "2025-12-18", "type": "access-control", "cve": "CVE-2025-63389", "ghsa": "GHSA-f6mr-38g8-39rg", "tools": [ "ollama" ], "categories": [ "frameworks" ], "summary": "A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.", "sources": [ { "title": "GitHub Security Advisory GHSA-f6mr-38g8-39rg", "url": "https://github.com/advisories/GHSA-f6mr-38g8-39rg" }, { "title": "NVD: CVE-2025-63389", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63389" } ] }, { "id": "cve-2025-66032-claude-code-command-validation-bypass-allows", "url": "https://vibevulns.pages.dev/issues/cve-2025-66032-claude-code-command-validation-bypass-allows/", "title": "CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code Execution", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-12-03", "type": "rce", "cve": "CVE-2025-66032", "ghsa": "GHSA-xq4m-mc3c-vvg3", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window.", "sources": [ { "title": "GitHub Security Advisory GHSA-xq4m-mc3c-vvg3", "url": "https://github.com/advisories/GHSA-xq4m-mc3c-vvg3" }, { "title": "NVD: CVE-2025-66032", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66032" } ] }, { "id": "cve-2025-66416-model-context-protocol-mcp-python-sdk-does-not", "url": "https://vibevulns.pages.dev/issues/cve-2025-66416-model-context-protocol-mcp-python-sdk-does-not/", "title": "CVE-2025-66416: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-12-02", "type": "ssrf", "cve": "CVE-2025-66416", "ghsa": "GHSA-9h52-p55h-vw2f", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers.", "sources": [ { "title": "GitHub Security Advisory GHSA-9h52-p55h-vw2f", "url": "https://github.com/advisories/GHSA-9h52-p55h-vw2f" }, { "title": "NVD: CVE-2025-66416", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66416" } ] }, { "id": "cve-2025-66414-model-context-protocol-mcp-typescript-sdk-does", "url": "https://vibevulns.pages.dev/issues/cve-2025-66414-model-context-protocol-mcp-typescript-sdk-does/", "title": "CVE-2025-66414: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-12-02", "type": "ssrf", "cve": "CVE-2025-66414", "ghsa": "GHSA-w48q-cv73-mx4w", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers.", "sources": [ { "title": "GitHub Security Advisory GHSA-w48q-cv73-mx4w", "url": "https://github.com/advisories/GHSA-w48q-cv73-mx4w" }, { "title": "NVD: CVE-2025-66414", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66414" } ] }, { "id": "cve-2025-64755-anthropic-ai-claude-code-has-sed-command", "url": "https://vibevulns.pages.dev/issues/cve-2025-64755-anthropic-ai-claude-code-has-sed-command/", "title": "CVE-2025-64755: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-11-20", "type": "access-control", "cve": "CVE-2025-64755", "ghsa": "GHSA-7mv8-j34q-vp7q", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system.", "sources": [ { "title": "GitHub Security Advisory GHSA-7mv8-j34q-vp7q", "url": "https://github.com/advisories/GHSA-7mv8-j34q-vp7q" }, { "title": "NVD: CVE-2025-64755", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64755" } ] }, { "id": "cve-2025-65099-claude-code-vulnerable-to-command-execution-prior", "url": "https://vibevulns.pages.dev/issues/cve-2025-65099-claude-code-vulnerable-to-command-execution-prior/", "title": "CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialog", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-11-19", "type": "rce", "cve": "CVE-2025-65099", "ghsa": "GHSA-5hhx-v7f6-x7gv", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "When using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version.", "sources": [ { "title": "GitHub Security Advisory GHSA-5hhx-v7f6-x7gv", "url": "https://github.com/advisories/GHSA-5hhx-v7f6-x7gv" }, { "title": "NVD: CVE-2025-65099", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65099" } ] }, { "id": "camoleak-copilot-chat", "url": "https://vibevulns.pages.dev/issues/camoleak-copilot-chat/", "title": "CamoLeak: Copilot Chat leaked private source code", "severity": "critical", "severity_basis": "Researcher rating (Legit Security); no CVE listed", "date": "2025-10-08", "type": "data-leak", "cve": null, "ghsa": null, "tools": [ "copilot" ], "categories": [ "agents" ], "summary": "Legit Security reported a critical vulnerability in GitHub Copilot Chat that could leak private source code from a user’s repositories.", "sources": [ { "title": "Legit Security: CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code", "url": "https://www.legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code" } ] }, { "id": "cve-2025-59536-claude-code-can-execute-commands-prior-to-the", "url": "https://vibevulns.pages.dev/issues/cve-2025-59536-claude-code-can-execute-commands-prior-to-the/", "title": "CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialog", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-10-03", "type": "rce", "cve": "CVE-2025-59536", "ghsa": "GHSA-4fgq-fpq9-mr3g", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory.", "sources": [ { "title": "GitHub Security Advisory GHSA-4fgq-fpq9-mr3g", "url": "https://github.com/advisories/GHSA-4fgq-fpq9-mr3g" }, { "title": "NVD: CVE-2025-59536", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59536" } ] }, { "id": "gemini-trifecta", "url": "https://vibevulns.pages.dev/issues/gemini-trifecta/", "title": "Gemini Trifecta: three injection flaws in Google’s Gemini suite", "severity": "high", "severity_basis": "Researcher rating (Tenable); remediated by Google", "date": "2025-09-30", "type": "prompt-injection", "cve": null, "ghsa": null, "tools": [ "gemini" ], "categories": [ "models" ], "summary": "Tenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection.", "sources": [ { "title": "Tenable: The Trifecta: three new Gemini vulnerabilities", "url": "https://www.tenable.com/blog/the-trifecta-how-three-new-gemini-vulnerabilities-in-cloud-assist-search-model-and-browsing" } ] }, { "id": "cve-2025-59828-claude-code-vulnerable-to-arbitrary-code", "url": "https://vibevulns.pages.dev/issues/cve-2025-59828-claude-code-vulnerable-to-arbitrary-code/", "title": "CVE-2025-59828: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-09-24", "type": "rce", "cve": "CVE-2025-59828", "ghsa": "GHSA-2jjv-qf24-vfm4", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "When using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version.", "sources": [ { "title": "GitHub Security Advisory GHSA-2jjv-qf24-vfm4", "url": "https://github.com/advisories/GHSA-2jjv-qf24-vfm4" }, { "title": "NVD: CVE-2025-59828", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59828" } ] }, { "id": "cve-2025-59532-codex-has-sandbox-bypass-due-to-bug-in-path", "url": "https://vibevulns.pages.dev/issues/cve-2025-59532-codex-has-sandbox-bypass-due-to-bug-in-path/", "title": "CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logic", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-09-19", "type": "access-control", "cve": "CVE-2025-59532", "ghsa": "GHSA-w5fx-fh39-j5rw", "tools": [ "codex" ], "categories": [ "agents" ], "summary": "Due to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session.", "sources": [ { "title": "GitHub Security Advisory GHSA-w5fx-fh39-j5rw", "url": "https://github.com/advisories/GHSA-w5fx-fh39-j5rw" }, { "title": "NVD: CVE-2025-59532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59532" } ] }, { "id": "cve-2025-59041-claude-code-vulnerable-to-arbitrary-code", "url": "https://vibevulns.pages.dev/issues/cve-2025-59041-claude-code-vulnerable-to-arbitrary-code/", "title": "CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-09-10", "type": "rce", "cve": "CVE-2025-59041", "ghsa": "GHSA-j4h9-wv2m-wrf7", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "At startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace.", "sources": [ { "title": "GitHub Security Advisory GHSA-j4h9-wv2m-wrf7", "url": "https://github.com/advisories/GHSA-j4h9-wv2m-wrf7" }, { "title": "NVD: CVE-2025-59041", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59041" } ] }, { "id": "cve-2025-58764-claude-code-rg-vulnerability-does-not-protect", "url": "https://vibevulns.pages.dev/issues/cve-2025-58764-claude-code-rg-vulnerability-does-not-protect/", "title": "CVE-2025-58764: Claude Code rg vulnerability does not protect against approval prompt bypass", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-09-10", "type": "rce", "cve": "CVE-2025-58764", "ghsa": "GHSA-qxfv-fcpc-w36x", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window.", "sources": [ { "title": "GitHub Security Advisory GHSA-qxfv-fcpc-w36x", "url": "https://github.com/advisories/GHSA-qxfv-fcpc-w36x" }, { "title": "NVD: CVE-2025-58764", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58764" } ] }, { "id": "cve-2025-58444-mcp-inspector-is-vulnerable-to-potential-command", "url": "https://vibevulns.pages.dev/issues/cve-2025-58444-mcp-inspector-is-vulnerable-to-potential-command/", "title": "CVE-2025-58444: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-09-08", "type": "rce", "cve": "CVE-2025-58444", "ghsa": "GHSA-g9hg-qhmf-q45m", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "An XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server.", "sources": [ { "title": "GitHub Security Advisory GHSA-g9hg-qhmf-q45m", "url": "https://github.com/advisories/GHSA-g9hg-qhmf-q45m" }, { "title": "NVD: CVE-2025-58444", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58444" } ] }, { "id": "windsurf-prompt-injection-secrets", "url": "https://vibevulns.pages.dev/issues/windsurf-prompt-injection-secrets/", "title": "Windsurf: prompt injection leaks developer secrets", "severity": "high", "severity_basis": "Researcher rating; no CVE", "date": "2025-08-21", "type": "prompt-injection", "cve": null, "ghsa": null, "tools": [ "windsurf" ], "categories": [ "agents" ], "summary": "Embrace The Red showed how prompt injection in files the Cascade agent reads could get Windsurf to leak secrets from the developer’s machine.", "sources": [ { "title": "Embrace The Red: Hijacking Windsurf: How Prompt Injection Leaks Developer Secrets", "url": "https://embracethered.com/blog/posts/2025/windsurf-data-exfiltration-vulnerabilities/" } ] }, { "id": "cve-2025-55284-claude-code-s-permissive-default-allowlist", "url": "https://vibevulns.pages.dev/issues/cve-2025-55284-claude-code-s-permissive-default-allowlist/", "title": "CVE-2025-55284: Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-08-18", "type": "data-leak", "cve": "CVE-2025-55284", "ghsa": "GHSA-x5gv-jw7f-j6xj", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to an overly broad allowlist of safe commands, it was possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation.", "sources": [ { "title": "GitHub Security Advisory GHSA-x5gv-jw7f-j6xj", "url": "https://github.com/advisories/GHSA-x5gv-jw7f-j6xj" }, { "title": "NVD: CVE-2025-55284", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55284" } ] }, { "id": "cve-2025-53773-copilot-prompt-injection-rce", "url": "https://vibevulns.pages.dev/issues/cve-2025-53773-copilot-prompt-injection-rce/", "title": "CVE-2025-53773: GitHub Copilot prompt injection to code execution", "severity": "high", "severity_basis": "CVSS 3.1 score 7.8 (NVD)", "date": "2025-08-12", "type": "prompt-injection", "cve": "CVE-2025-53773", "ghsa": null, "tools": [ "copilot" ], "categories": [ "agents" ], "summary": "Command injection in GitHub Copilot and Visual Studio let an attacker run code on a developer’s machine. Embrace The Red showed it starting from a prompt injection in project content.", "sources": [ { "title": "NVD: CVE-2025-53773", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53773" }, { "title": "Embrace The Red: GitHub Copilot Remote Code Execution via Prompt Injection", "url": "https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/" } ] }, { "id": "cve-2025-54795-claude-code-echo-command-allowed-bypass-of-user", "url": "https://vibevulns.pages.dev/issues/cve-2025-54795-claude-code-echo-command-allowed-bypass-of-user/", "title": "CVE-2025-54795: Claude Code echo command allowed bypass of user approval prompt for command execution", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-08-04", "type": "rce", "cve": "CVE-2025-54795", "ghsa": "GHSA-x56v-x2h6-7j34", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window.", "sources": [ { "title": "GitHub Security Advisory GHSA-x56v-x2h6-7j34", "url": "https://github.com/advisories/GHSA-x56v-x2h6-7j34" }, { "title": "NVD: CVE-2025-54795", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54795" } ] }, { "id": "cve-2025-54794-claude-code-research-preview-has-a-path", "url": "https://vibevulns.pages.dev/issues/cve-2025-54794-claude-code-research-preview-has-a-path/", "title": "CVE-2025-54794: Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-08-04", "type": "access-control", "cve": "CVE-2025-54794", "ghsa": "GHSA-pmw4-pwvc-3hx2", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD.", "sources": [ { "title": "GitHub Security Advisory GHSA-pmw4-pwvc-3hx2", "url": "https://github.com/advisories/GHSA-pmw4-pwvc-3hx2" }, { "title": "NVD: CVE-2025-54794", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54794" } ] }, { "id": "cve-2025-54135-cursor-curxecute", "url": "https://vibevulns.pages.dev/issues/cve-2025-54135-cursor-curxecute/", "title": "CVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run code", "severity": "high", "severity_basis": "CVSS 3.1 score 8.6 (CVE record)", "date": "2025-08", "type": "prompt-injection", "cve": "CVE-2025-54135", "ghsa": null, "tools": [ "cursor" ], "categories": [ "agents" ], "summary": "Before 1.3.9, Cursor let the agent create new dotfiles like .cursor/mcp.json without approval. Chained with prompt injection, this meant remote code execution.", "sources": [ { "title": "CVE Record: CVE-2025-54135", "url": "https://www.cve.org/CVERecord?id=CVE-2025-54135" }, { "title": "Cursor advisory GHSA-4cxx-hrm3-49rm", "url": "https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm" }, { "title": "Cursor advisory GHSA-vqv7-vq92-x87f", "url": "https://github.com/cursor/cursor/security/advisories/GHSA-vqv7-vq92-x87f" } ] }, { "id": "cve-2025-54136-cursor-mcpoison", "url": "https://vibevulns.pages.dev/issues/cve-2025-54136-cursor-mcpoison/", "title": "CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swapped", "severity": "high", "severity_basis": "VibeVulns rating: persistent RCE requires repo write access", "date": "2025-08", "type": "agent-hijack", "cve": "CVE-2025-54136", "ghsa": null, "tools": [ "cursor", "mcp" ], "categories": [ "agents", "mcp" ], "summary": "In Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt.", "sources": [ { "title": "NVD: CVE-2025-54136", "url": "https://nvd.nist.gov/vuln/detail/cve-2025-54136" }, { "title": "Cursor advisory GHSA-24mc-g4xr-4395", "url": "https://github.com/cursor/cursor/security/advisories/GHSA-24mc-g4xr-4395" } ] }, { "id": "cve-2025-8217-amazon-q-malicious-code", "url": "https://vibevulns.pages.dev/issues/cve-2025-8217-amazon-q-malicious-code/", "title": "CVE-2025-8217: malicious code shipped in Amazon Q Developer 1.84.0", "severity": "high", "severity_basis": "AWS security bulletin AWS-2025-015", "date": "2025-07-23", "type": "supply-chain", "cve": "CVE-2025-8217", "ghsa": null, "tools": [ "amazon-q" ], "categories": [ "agents" ], "summary": "An over-scoped GitHub token in Amazon Q’s build setup let an attacker commit malicious code that shipped in the VS Code extension 1.84.0. AWS says it failed to run due to a syntax error.", "sources": [ { "title": "AWS Security Bulletin AWS-2025-015", "url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-015/" } ] }, { "id": "grok-4-echo-chamber-jailbreak", "url": "https://vibevulns.pages.dev/issues/grok-4-echo-chamber-jailbreak/", "title": "Grok 4 jailbroken within 48 hours of launch", "severity": "medium", "severity_basis": "Model safety research; no CVE", "date": "2025-07-11", "type": "jailbreak", "cve": null, "ghsa": null, "tools": [ "xai" ], "categories": [ "models" ], "summary": "NeuralTrust combined its Echo Chamber and Crescendo multi-turn techniques to jailbreak Grok 4 two days after release.", "sources": [ { "title": "NeuralTrust: Grok-4 Jailbreak: Echo Chamber and Crescendo", "url": "https://neuraltrust.ai/blog/grok-4-jailbreak-echo-chamber-and-crescendo" } ] }, { "id": "cve-2025-6514-mcp-remote-exposed-to-os-command-injection-via", "url": "https://vibevulns.pages.dev/issues/cve-2025-6514-mcp-remote-exposed-to-os-command-injection-via/", "title": "CVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connections", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.6)", "date": "2025-07-09", "type": "rce", "cve": "CVE-2025-6514", "ghsa": "GHSA-6xpm-ggf7-wc3p", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL", "sources": [ { "title": "GitHub Security Advisory GHSA-6xpm-ggf7-wc3p", "url": "https://github.com/advisories/GHSA-6xpm-ggf7-wc3p" }, { "title": "NVD: CVE-2025-6514", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6514" } ] }, { "id": "supabase-mcp-prompt-injection", "url": "https://vibevulns.pages.dev/issues/supabase-mcp-prompt-injection/", "title": "Supabase MCP: a support ticket gets the agent to dump private tables", "severity": "high", "severity_basis": "Researcher demonstration; no CVE", "date": "2025-07-08", "type": "prompt-injection", "cve": null, "ghsa": null, "tools": [ "mcp", "supabase", "cursor", "lovable" ], "categories": [ "mcp", "stack", "agents", "builders" ], "summary": "General Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role.", "sources": [ { "title": "General Analysis: Supabase MCP prompt injection", "url": "https://www.generalanalysis.com/blog/supabase-mcp-blog" }, { "title": "Supabase: Defense in depth for MCP servers", "url": "https://supabase.com/blog/defense-in-depth-mcp" } ] }, { "id": "cve-2025-53366-mcp-python-sdk-vulnerability-in-the-fastmcp", "url": "https://vibevulns.pages.dev/issues/cve-2025-53366-mcp-python-sdk-vulnerability-in-the-fastmcp/", "title": "CVE-2025-53366: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-07-04", "type": "dos", "cve": "CVE-2025-53366", "ghsa": "GHSA-3qhf-m339-9g5v", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures.", "sources": [ { "title": "GitHub Security Advisory GHSA-3qhf-m339-9g5v", "url": "https://github.com/advisories/GHSA-3qhf-m339-9g5v" }, { "title": "NVD: CVE-2025-53366", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53366" } ] }, { "id": "cve-2025-53365-mcp-python-sdk-has-unhandled-exception-in", "url": "https://vibevulns.pages.dev/issues/cve-2025-53365-mcp-python-sdk-has-unhandled-exception-in/", "title": "CVE-2025-53365: MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-07-04", "type": "dos", "cve": "CVE-2025-53365", "ghsa": "GHSA-j975-95f5-7wqh", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "If a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service.", "sources": [ { "title": "GitHub Security Advisory GHSA-j975-95f5-7wqh", "url": "https://github.com/advisories/GHSA-j975-95f5-7wqh" }, { "title": "NVD: CVE-2025-53365", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53365" } ] }, { "id": "cve-2025-53110-modelcontextprotocol-server-filesystem", "url": "https://vibevulns.pages.dev/issues/cve-2025-53110-modelcontextprotocol-server-filesystem/", "title": "CVE-2025-53110: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-07-01", "type": "access-control", "cve": "CVE-2025-53110", "ghsa": "GHSA-hc55-p739-j48w", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue.", "sources": [ { "title": "GitHub Security Advisory GHSA-hc55-p739-j48w", "url": "https://github.com/advisories/GHSA-hc55-p739-j48w" }, { "title": "NVD: CVE-2025-53110", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53110" } ] }, { "id": "cve-2025-53109-modelcontextprotocol-server-filesystem-allows-for", "url": "https://vibevulns.pages.dev/issues/cve-2025-53109-modelcontextprotocol-server-filesystem-allows-for/", "title": "CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-07-01", "type": "access-control", "cve": "CVE-2025-53109", "ghsa": "GHSA-q66q-fx2p-7w4m", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve.", "sources": [ { "title": "GitHub Security Advisory GHSA-q66q-fx2p-7w4m", "url": "https://github.com/advisories/GHSA-q66q-fx2p-7w4m" }, { "title": "NVD: CVE-2025-53109", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53109" } ] }, { "id": "base44-private-app-auth-bypass", "url": "https://vibevulns.pages.dev/issues/base44-private-app-auth-bypass/", "title": "Base44: private apps open to anyone with the app_id (Wiz)", "severity": "critical", "severity_basis": "Rated critical by Wiz Research", "date": "2025-07", "type": "access-control", "cve": null, "ghsa": null, "tools": [ "base44" ], "categories": [ "builders" ], "summary": "Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours.", "sources": [ { "title": "Wiz: Critical Vulnerability in AI Vibe Coding platform Base44", "url": "https://www.wiz.io/blog/critical-vulnerability-base44" }, { "title": "SecurityWeek: Flaw in Base44 exposed private enterprise apps", "url": "https://www.securityweek.com/flaw-in-vibe-coding-platform-base44-exposed-private-enterprise-applications/" }, { "title": "The Hacker News: Wiz uncovers access bypass flaw in Base44", "url": "https://thehackernews.com/2025/07/wiz-uncovers-critical-access-bypass.html" } ] }, { "id": "replit-agent-deleted-production-database", "url": "https://vibevulns.pages.dev/issues/replit-agent-deleted-production-database/", "title": "AI agent deleted a production database during a code freeze (Replit)", "severity": "high", "severity_basis": "VibeVulns rating: data loss, recoverable via rollback", "date": "2025-07", "type": "ops", "cve": null, "ghsa": null, "tools": [ "replit", "cursor" ], "categories": [ "builders", "agents" ], "summary": "Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible.", "sources": [ { "title": "The Register: Replit deleted production database", "url": "https://www.theregister.com/software/2025/07/21/vibe-coding-service-replit-deleted-production-database/719783" }, { "title": "Fast Company: Replit CEO on what happened", "url": "https://www.fastcompany.com/91372483/replit-ceo-what-really-happened-when-ai-agent-wiped-jason-lemkins-database-exclusive" } ] }, { "id": "cve-2025-52882-claude-code-improper-authorization-via-websocket", "url": "https://vibevulns.pages.dev/issues/cve-2025-52882-claude-code-improper-authorization-via-websocket/", "title": "CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary origins", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-06-23", "type": "access-control", "cve": "CVE-2025-52882", "ghsa": "GHSA-9f65-56v6-gxw7", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when visiting attacker-controlled webpages.", "sources": [ { "title": "GitHub Security Advisory GHSA-9f65-56v6-gxw7", "url": "https://github.com/advisories/GHSA-9f65-56v6-gxw7" }, { "title": "NVD: CVE-2025-52882", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52882" } ] }, { "id": "cve-2025-49596-mcp-inspector-proxy-server-lacks-authentication", "url": "https://vibevulns.pages.dev/issues/cve-2025-49596-mcp-inspector-proxy-server-lacks-authentication/", "title": "CVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxy", "severity": "critical", "severity_basis": "GitHub advisory severity: critical", "date": "2025-06-13", "type": "rce", "cve": "CVE-2025-49596", "ghsa": "GHSA-7f8r-222p-6f5g", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio.", "sources": [ { "title": "GitHub Security Advisory GHSA-7f8r-222p-6f5g", "url": "https://github.com/advisories/GHSA-7f8r-222p-6f5g" }, { "title": "NVD: CVE-2025-49596", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49596" } ] }, { "id": "cve-2025-32711-echoleak-m365-copilot", "url": "https://vibevulns.pages.dev/issues/cve-2025-32711-echoleak-m365-copilot/", "title": "CVE-2025-32711 (EchoLeak): zero-click data leak in Microsoft 365 Copilot", "severity": "critical", "severity_basis": "CVSS 3.1 score 9.3 (CNA)", "date": "2025-06-11", "type": "prompt-injection", "cve": "CVE-2025-32711", "ghsa": null, "tools": [ "copilot" ], "categories": [ "agents" ], "summary": "AI command injection in Microsoft 365 Copilot let an unauthorised attacker disclose information over a network. Microsoft fixed it server-side.", "sources": [ { "title": "NVD: CVE-2025-32711", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32711" } ] }, { "id": "cve-2025-1793-llama-index-vulnerable-to-sql", "url": "https://vibevulns.pages.dev/issues/cve-2025-1793-llama-index-vulnerable-to-sql/", "title": "CVE-2025-1793: llama_index vulnerable to SQL Injection", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2025-06-05", "type": "access-control", "cve": "CVE-2025-1793", "ghsa": "GHSA-v3c8-3pr6-gr7p", "tools": [ "llamaindex" ], "categories": [ "frameworks" ], "summary": "Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities.", "sources": [ { "title": "GitHub Security Advisory GHSA-v3c8-3pr6-gr7p", "url": "https://github.com/advisories/GHSA-v3c8-3pr6-gr7p" }, { "title": "NVD: CVE-2025-1793", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1793" } ] }, { "id": "github-mcp-private-repo-leak", "url": "https://vibevulns.pages.dev/issues/github-mcp-private-repo-leak/", "title": "GitHub MCP server: a public issue makes the agent leak private repos", "severity": "high", "severity_basis": "Researcher rating (Invariant Labs called it critical); no CVE", "date": "2025-05-26", "type": "agent-hijack", "cve": null, "ghsa": null, "tools": [ "mcp", "claude-code", "cursor", "copilot" ], "categories": [ "mcp", "agents" ], "summary": "Invariant Labs showed that a prompt injection planted in a public GitHub issue could get an agent using the official GitHub MCP server to pull data from the user’s private repositories.", "sources": [ { "title": "Invariant Labs: GitHub MCP Exploited: Accessing private repositories via MCP", "url": "https://invariantlabs.ai/blog/mcp-github-vulnerability" } ] }, { "id": "cve-2025-47277-vllm-allows-remote-code-execution-via-pyncclpipe", "url": "https://vibevulns.pages.dev/issues/cve-2025-47277-vllm-allows-remote-code-execution-via-pyncclpipe/", "title": "CVE-2025-47277: vLLM Allows Remote Code Execution via PyNcclPipe Communication Service", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2025-05-20", "type": "rce", "cve": "CVE-2025-47277", "ghsa": "GHSA-hjq4-87xh-g4fv", "tools": [ "vllm" ], "categories": [ "frameworks" ], "summary": "vLLM Allows Remote Code Execution via PyNcclPipe Communication Service.", "sources": [ { "title": "GitHub Security Advisory GHSA-hjq4-87xh-g4fv", "url": "https://github.com/advisories/GHSA-hjq4-87xh-g4fv" }, { "title": "NVD: CVE-2025-47277", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47277" } ] }, { "id": "cve-2025-48757-lovable-missing-rls", "url": "https://vibevulns.pages.dev/issues/cve-2025-48757-lovable-missing-rls/", "title": "CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLS", "severity": "critical", "severity_basis": "CVSS 3.1 score 9.3 (CVE record)", "date": "2025-05", "type": "access-control", "cve": "CVE-2025-48757", "ghsa": null, "tools": [ "lovable", "supabase" ], "categories": [ "builders", "stack" ], "summary": "Lovable-generated apps talked to Supabase directly from the browser, but many tables had no (or wrong) Row Level Security policies, so anyone with the public anon key could read or write data.", "sources": [ { "title": "CVE Record: CVE-2025-48757", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48757" }, { "title": "Matt Palmer: CVE-2025-48757 write-up", "url": "https://mattpalmer.io/posts/2025/05/CVE-2025-48757/" }, { "title": "Matt Palmer: Statement on CVE-2025-48757", "url": "https://mattpalmer.io/posts/2025/05/statement-on-CVE-2025-48757/" } ] }, { "id": "cve-2025-32444-vllm-vulnerable-to-remote-code-execution-via", "url": "https://vibevulns.pages.dev/issues/cve-2025-32444-vllm-vulnerable-to-remote-code-execution-via/", "title": "CVE-2025-32444: vLLM Vulnerable to Remote Code Execution via Mooncake Integration", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 10)", "date": "2025-04-29", "type": "rce", "cve": "CVE-2025-32444", "ghsa": "GHSA-hj4w-hm2g-p6w5", "tools": [ "vllm" ], "categories": [ "frameworks" ], "summary": "vLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets.", "sources": [ { "title": "GitHub Security Advisory GHSA-hj4w-hm2g-p6w5", "url": "https://github.com/advisories/GHSA-hj4w-hm2g-p6w5" }, { "title": "NVD: CVE-2025-32444", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32444" } ] }, { "id": "mcp-tool-poisoning-attacks", "url": "https://vibevulns.pages.dev/issues/mcp-tool-poisoning-attacks/", "title": "MCP tool poisoning: hidden instructions in tool descriptions", "severity": "high", "severity_basis": "Researcher rating (Invariant Labs called it critical); no CVE", "date": "2025-04-01", "type": "prompt-injection", "cve": null, "ghsa": null, "tools": [ "mcp", "cursor", "claude-code", "windsurf", "cline" ], "categories": [ "mcp", "agents" ], "summary": "An MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere.", "sources": [ { "title": "Invariant Labs: MCP Security Notification: Tool Poisoning Attacks", "url": "https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks" } ] }, { "id": "cve-2025-29927-nextjs-middleware-bypass", "url": "https://vibevulns.pages.dev/issues/cve-2025-29927-nextjs-middleware-bypass/", "title": "CVE-2025-29927: Next.js middleware authorization bypass", "severity": "critical", "severity_basis": "Critical severity (GitHub Advisory)", "date": "2025-03", "type": "access-control", "cve": "CVE-2025-29927", "ghsa": null, "tools": [ "nextjs", "v0", "bolt", "cursor", "replit" ], "categories": [ "stack", "builders", "agents" ], "summary": "Self-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0.", "sources": [ { "title": "GitHub Advisory GHSA-f82v-jwr5-mffw (CVE-2025-29927)", "url": "https://github.com/advisories/ghsa-f82v-jwr5-mffw" }, { "title": "Vercel: Postmortem on Next.js Middleware bypass", "url": "https://vercel.com/blog/postmortem-on-next-js-middleware-bypass" } ] }, { "id": "rules-file-backdoor", "url": "https://vibevulns.pages.dev/issues/rules-file-backdoor/", "title": "“Rules File Backdoor”: hidden Unicode instructions in AI rules files", "severity": "high", "severity_basis": "VibeVulns rating: supply-chain attack invisible in code review", "date": "2025-03", "type": "supply-chain", "cve": null, "ghsa": null, "tools": [ "cursor", "copilot" ], "categories": [ "agents" ], "summary": "Pillar Security showed invisible Unicode characters in shared rules files (.cursorrules, .mdc) can steer Cursor and GitHub Copilot into writing backdoored code.", "sources": [ { "title": "Pillar Security: Rules File Backdoor", "url": "https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents" }, { "title": "Pillar Security: Rule File Scanner", "url": "https://rule-scan.pillar.security/" } ] }, { "id": "middleware-only-route-protection", "url": "https://vibevulns.pages.dev/issues/middleware-only-route-protection/", "title": "Protecting routes only in middleware", "severity": "medium", "severity_basis": "VibeVulns rating: design weakness, not a single bug", "date": "2025-03", "type": "access-control", "cve": null, "ghsa": null, "tools": [ "nextjs", "v0", "bolt", "cursor", "replit" ], "categories": [ "stack", "builders", "agents" ], "summary": "Vercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed.", "sources": [ { "title": "Vercel: Postmortem on Next.js Middleware bypass", "url": "https://vercel.com/blog/postmortem-on-next-js-middleware-bypass" } ] }, { "id": "deepseek-r1-jailbreak-evaluation", "url": "https://vibevulns.pages.dev/issues/deepseek-r1-jailbreak-evaluation/", "title": "DeepSeek R1 failed every harmful-prompt test in Cisco’s evaluation", "severity": "medium", "severity_basis": "Model safety evaluation; no CVE", "date": "2025-01-31", "type": "jailbreak", "cve": null, "ghsa": null, "tools": [ "deepseek" ], "categories": [ "models" ], "summary": "Cisco ran algorithmic jailbreak testing against DeepSeek and other frontier reasoning models and published the results on 31 January 2025.", "sources": [ { "title": "Cisco: Evaluating Security Risk in DeepSeek and Other Frontier Reasoning Models", "url": "https://blogs.cisco.com/security/evaluating-security-risk-in-deepseek-and-other-frontier-reasoning-models" } ] }, { "id": "deepseek-exposed-clickhouse-database", "url": "https://vibevulns.pages.dev/issues/deepseek-exposed-clickhouse-database/", "title": "DeepSeek left a database open with chat history and secrets", "severity": "critical", "severity_basis": "Researcher rating (Wiz); vendor incident", "date": "2025-01-29", "type": "data-leak", "cve": null, "ghsa": null, "tools": [ "deepseek" ], "categories": [ "models" ], "summary": "Wiz found a publicly accessible DeepSeek database that allowed full control over database operations, exposing over a million lines of logs with chat history and other sensitive data.", "sources": [ { "title": "Wiz: Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information", "url": "https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak" } ] }, { "id": "client-side-only-auth", "url": "https://vibevulns.pages.dev/issues/client-side-only-auth/", "title": "Authentication logic living entirely in the browser", "severity": "high", "severity_basis": "VibeVulns rating: auth checks can be skipped by calling the API directly", "date": "2025", "type": "access-control", "cve": null, "ghsa": null, "tools": [ "lovable", "base44", "bolt", "v0", "replit", "cursor" ], "categories": [ "builders", "agents" ], "summary": "Hiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly.", "sources": [ { "title": "Escape: State of Security of Vibe Coded Apps 2025 (PDF)", "url": "https://26857953.fs1.hubspotusercontent-eu1.net/hubfs/26857953/State-Security-Vibe%20Coded%20Apps%20Report%202025%20Escape.pdf" } ] }, { "id": "slopsquatting-hallucinated-packages", "url": "https://vibevulns.pages.dev/issues/slopsquatting-hallucinated-packages/", "title": "Slopsquatting: AI suggests packages that don’t exist", "severity": "high", "severity_basis": "VibeVulns rating: can install attacker-controlled code", "date": "2025", "type": "supply-chain", "cve": null, "ghsa": null, "tools": [ "claude-code", "copilot", "cursor", "lovable", "bolt", "v0", "replit", "base44" ], "categories": [ "agents", "builders" ], "summary": "A USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names.", "sources": [ { "title": "arXiv: We Have a Package for You! (USENIX Security 2025)", "url": "https://arxiv.org/html/2406.10279v2" }, { "title": "USENIX ;login: Package Hallucinations", "url": "https://www.usenix.org/publications/loginonline/we-have-package-you-comprehensive-analysis-package-hallucinations-code" } ] }, { "id": "cve-2024-11393-deserialization-of-untrusted-data-in-hugging-face", "url": "https://vibevulns.pages.dev/issues/cve-2024-11393-deserialization-of-untrusted-data-in-hugging-face/", "title": "CVE-2024-11393: Deserialization of Untrusted Data in Hugging Face Transformers", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.8)", "date": "2024-11-23", "type": "rce", "cve": "CVE-2024-11393", "ghsa": "GHSA-wrfc-pvp9-mr9g", "tools": [ "transformers" ], "categories": [ "frameworks" ], "summary": "Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers.", "sources": [ { "title": "GitHub Security Advisory GHSA-wrfc-pvp9-mr9g", "url": "https://github.com/advisories/GHSA-wrfc-pvp9-mr9g" }, { "title": "NVD: CVE-2024-11393", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11393" } ] }, { "id": "cve-2024-11394-deserialization-of-untrusted-data-in-hugging-face", "url": "https://vibevulns.pages.dev/issues/cve-2024-11394-deserialization-of-untrusted-data-in-hugging-face/", "title": "CVE-2024-11394: Deserialization of Untrusted Data in Hugging Face Transformers", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.8)", "date": "2024-11-23", "type": "rce", "cve": "CVE-2024-11394", "ghsa": "GHSA-hxxf-235m-72v3", "tools": [ "transformers" ], "categories": [ "frameworks" ], "summary": "Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers.", "sources": [ { "title": "GitHub Security Advisory GHSA-hxxf-235m-72v3", "url": "https://github.com/advisories/GHSA-hxxf-235m-72v3" }, { "title": "NVD: CVE-2024-11394", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11394" } ] }, { "id": "owasp-llm01-prompt-injection", "url": "https://vibevulns.pages.dev/issues/owasp-llm01-prompt-injection/", "title": "OWASP LLM01:2025: prompt injection is the top LLM app risk", "severity": "high", "severity_basis": "OWASP Top 10 for LLM Applications 2025, rank 1", "date": "2024-11-18", "type": "prompt-injection", "cve": null, "ghsa": null, "tools": [ "openai", "anthropic", "gemini", "llama", "mistral", "deepseek", "xai" ], "categories": [ "models" ], "summary": "OWASP ranks prompt injection first in its Top 10 for LLM Applications 2025. Any app that feeds untrusted text to a model with tools or data access is exposed.", "sources": [ { "title": "OWASP GenAI: LLM01:2025 Prompt Injection", "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/" } ] }, { "id": "cve-2024-50050-llama-stack-pickle", "url": "https://vibevulns.pages.dev/issues/cve-2024-50050-llama-stack-pickle/", "title": "CVE-2024-50050: Llama Stack used pickle over sockets", "severity": "medium", "severity_basis": "CVSS 3.1 score 6.3 (NVD)", "date": "2024-10-23", "type": "rce", "cve": "CVE-2024-50050", "ghsa": null, "tools": [ "llama" ], "categories": [ "models" ], "summary": "Meta’s Llama Stack used Python pickle to deserialise socket messages, which could allow remote code execution. It switched to JSON.", "sources": [ { "title": "NVD: CVE-2024-50050", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50050" } ] }, { "id": "chatgpt-spaiware-memory-injection", "url": "https://vibevulns.pages.dev/issues/chatgpt-spaiware-memory-injection/", "title": "SpAIware: prompt injection writes into ChatGPT’s long-term memory", "severity": "high", "severity_basis": "Researcher rating; no CVE", "date": "2024-09-20", "type": "prompt-injection", "cve": null, "ghsa": null, "tools": [ "openai" ], "categories": [ "models" ], "summary": "Embrace The Red showed untrusted content planting persistent instructions in ChatGPT’s memory on the macOS app, so later chats kept sending data to the attacker.", "sources": [ { "title": "Embrace The Red: Spyware Injection Into Your ChatGPT’s Long-Term Memory (SpAIware)", "url": "https://embracethered.com/blog/posts/2024/chatgpt-macos-app-persistent-data-exfiltration/" } ] }, { "id": "cve-2024-46946-langchain-experimental-eval-injection", "url": "https://vibevulns.pages.dev/issues/cve-2024-46946-langchain-experimental-eval-injection/", "title": "CVE-2024-46946: LangChain Experimental Eval Injection vulnerability", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2024-09-19", "type": "rce", "cve": "CVE-2024-46946", "ghsa": "GHSA-p2qj-r53j-h3xj", "tools": [ "langchain" ], "categories": [ "frameworks" ], "summary": "langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05).", "sources": [ { "title": "GitHub Security Advisory GHSA-p2qj-r53j-h3xj", "url": "https://github.com/advisories/GHSA-p2qj-r53j-h3xj" }, { "title": "NVD: CVE-2024-46946", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46946" } ] }, { "id": "cve-2024-45201-llamaindex-includes-an-exec-call-for-import-cls", "url": "https://vibevulns.pages.dev/issues/cve-2024-45201-llamaindex-includes-an-exec-call-for-import-cls/", "title": "CVE-2024-45201: LlamaIndex includes an exec call for `import {cls_name}`", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2024-08-22", "type": "rce", "cve": "CVE-2024-45201", "ghsa": "GHSA-fxc2-8m62-m85x", "tools": [ "llamaindex" ], "categories": [ "frameworks" ], "summary": "An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}.", "sources": [ { "title": "GitHub Security Advisory GHSA-fxc2-8m62-m85x", "url": "https://github.com/advisories/GHSA-fxc2-8m62-m85x" }, { "title": "NVD: CVE-2024-45201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45201" } ] }, { "id": "cve-2024-3271-llama-index-core-command-injection", "url": "https://vibevulns.pages.dev/issues/cve-2024-3271-llama-index-core-command-injection/", "title": "CVE-2024-3271: llama-index-core Command Injection vulnerability", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2024-04-16", "type": "rce", "cve": "CVE-2024-3271", "ghsa": "GHSA-r6gp-rff2-p3hf", "tools": [ "llamaindex" ], "categories": [ "frameworks" ], "summary": "A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code.", "sources": [ { "title": "GitHub Security Advisory GHSA-r6gp-rff2-p3hf", "url": "https://github.com/advisories/GHSA-r6gp-rff2-p3hf" }, { "title": "NVD: CVE-2024-3271", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3271" } ] }, { "id": "cve-2024-28224-ollama-dns-rebinding", "url": "https://vibevulns.pages.dev/issues/cve-2024-28224-ollama-dns-rebinding/", "title": "CVE-2024-28224: Ollama DNS rebinding vulnerability", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.8)", "date": "2024-04-08", "type": "ssrf", "cve": "CVE-2024-28224", "ghsa": "GHSA-5jx5-hqx5-2vrj", "tools": [ "ollama" ], "categories": [ "frameworks" ], "summary": "Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).", "sources": [ { "title": "GitHub Security Advisory GHSA-5jx5-hqx5-2vrj", "url": "https://github.com/advisories/GHSA-5jx5-hqx5-2vrj" }, { "title": "NVD: CVE-2024-28224", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28224" } ] }, { "id": "many-shot-jailbreaking", "url": "https://vibevulns.pages.dev/issues/many-shot-jailbreaking/", "title": "Many-shot jailbreaking: long context windows weaken refusals", "severity": "medium", "severity_basis": "Vendor research; no CVE", "date": "2024-04-02", "type": "jailbreak", "cve": null, "ghsa": null, "tools": [ "anthropic", "openai", "gemini", "llama", "mistral" ], "categories": [ "models" ], "summary": "Anthropic published research showing that filling a long prompt with many fake dialogue examples can push models into answering requests they would normally refuse.", "sources": [ { "title": "Anthropic: Many-shot jailbreaking", "url": "https://www.anthropic.com/research/many-shot-jailbreaking" } ] }, { "id": "cve-2024-27444-langchain-experimental-vulnerable-to-arbitrary", "url": "https://vibevulns.pages.dev/issues/cve-2024-27444-langchain-experimental-vulnerable-to-arbitrary/", "title": "CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code execution", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2024-02-26", "type": "rce", "cve": "CVE-2024-27444", "ghsa": "GHSA-v8vj-cv27-hjv8", "tools": [ "langchain" ], "categories": [ "frameworks" ], "summary": "langchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__…", "sources": [ { "title": "GitHub Security Advisory GHSA-v8vj-cv27-hjv8", "url": "https://github.com/advisories/GHSA-v8vj-cv27-hjv8" }, { "title": "NVD: CVE-2024-27444", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27444" } ] }, { "id": "cve-2023-6730-transformers-has-a-deserialization-of-untrusted", "url": "https://vibevulns.pages.dev/issues/cve-2023-6730-transformers-has-a-deserialization-of-untrusted/", "title": "CVE-2023-6730: transformers has a Deserialization of Untrusted Data vulnerability", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9)", "date": "2023-12-19", "type": "rce", "cve": "CVE-2023-6730", "ghsa": "GHSA-3863-2447-669p", "tools": [ "transformers" ], "categories": [ "frameworks" ], "summary": "Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0.", "sources": [ { "title": "GitHub Security Advisory GHSA-3863-2447-669p", "url": "https://github.com/advisories/GHSA-3863-2447-669p" }, { "title": "NVD: CVE-2023-6730", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6730" } ] }, { "id": "cve-2023-32785-langchain-sql-injection", "url": "https://vibevulns.pages.dev/issues/cve-2023-32785-langchain-sql-injection/", "title": "CVE-2023-32785: Langchain SQL Injection vulnerability", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2023-10-21", "type": "prompt-injection", "cve": "CVE-2023-32785", "ghsa": "GHSA-8h5w-f6q9-wg35", "tools": [ "langchain" ], "categories": [ "frameworks" ], "summary": "In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.", "sources": [ { "title": "GitHub Security Advisory GHSA-8h5w-f6q9-wg35", "url": "https://github.com/advisories/GHSA-8h5w-f6q9-wg35" }, { "title": "NVD: CVE-2023-32785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32785" } ] } ] }