Category · 44 advisories
IDEs & agents
AI code editors, coding agents and CLIs that read and write your repo.
Cline1
Roo Code0
Devin0Timeline · advisories per quarter
52025 Q1
42025 Q2
142025 Q3
52025 Q4
72026 Q1
42026 Q2
42026 Q3
12026 Q4
All advisories, worst first
01. Supabase tables readable by anyone with no loginA scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login. 
Lovable 
Bolt 
v0 +4 more 2026-08 02. Supabase service_role / secret key shipped to the browserThe service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public. Lovable Bolt v0 +4 more 2026-08 03. CVE-2026-12537: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypassesGemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. 
Gemini CLI 2026-04-24 04. CVE-2025-61260: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration filesA vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. 
Codex CLI 2026-04-14 05. CamoLeak: Copilot Chat leaked private source codeLegit Security reported a critical vulnerability in GitHub Copilot Chat that could leak private source code from a user’s repositories. 
Copilot 2025-10-08 06. CVE-2025-32711 (EchoLeak): zero-click data leak in Microsoft 365 CopilotAI command injection in Microsoft 365 Copilot let an unauthorised attacker disclose information over a network. Microsoft fixed it server-side. Copilot 2025-06-11 07. CVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. 
Next.js v0 Bolt +2 more 2025-03 08. CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningThe plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. 
Claude Code 2026-10-15 09. Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. Lovable Bolt v0 +4 more 2026-08 10. CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionClaude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. Claude Code 2026-07-24 11. CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code ExecutionClaude Code used the git worktree commondir file when determining folder trust but did not validate its contents. Claude Code 2026-04-24 12. CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceClaude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. Claude Code 2026-04-21 13. CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings FileClaude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. Claude Code 2026-03-19 14. CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.jsonClaude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. Claude Code 2026-02-06 15. CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write RestrictionsClaude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Claude Code 2026-02-06 16. CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write ProtectionClaude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Claude Code 2026-02-06 17. CVE-2026-24887: Claude Code has a Command Injection in find Command Bypasses User Approval PromptDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Claude Code 2026-02-03 18. CVE-2026-24053: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File WritesDue to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Claude Code 2026-02-03 19. CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled DomainsClaude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. Claude Code 2026-02-03 20. CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code ExecutionDue to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-12-03 21. CVE-2025-64755: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File WritesDue to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. Claude Code 2025-11-20 22. CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialogWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-11-19 23. CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialogDue to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Claude Code 2025-10-03 24. CVE-2025-59828: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn VersionsWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-09-24 25. CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logicDue to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. Codex CLI 2025-09-19 26. CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git emailAt startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace. Claude Code 2025-09-10 27. CVE-2025-58764: Claude Code rg vulnerability does not protect against approval prompt bypassDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-09-10 28. Windsurf: prompt injection leaks developer secretsEmbrace The Red showed how prompt injection in files the Cascade agent reads could get Windsurf to leak secrets from the developer’s machine. 
Windsurf 2025-08-21 29. CVE-2025-55284: Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude CodeDue to an overly broad allowlist of safe commands, it was possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation. Claude Code 2025-08-18 30. CVE-2025-53773: GitHub Copilot prompt injection to code executionCommand injection in GitHub Copilot and Visual Studio let an attacker run code on a developer’s machine. Embrace The Red showed it starting from a prompt injection in project content. Copilot 2025-08-12 31. CVE-2025-54795: Claude Code echo command allowed bypass of user approval prompt for command executionDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-08-04 32. CVE-2025-54794: Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file accessDue to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Claude Code 2025-08-04 33. CVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeBefore 1.3.9, Cursor let the agent create new dotfiles like .cursor/mcp.json without approval. Chained with prompt injection, this meant remote code execution. 
Cursor 2025-08 34. CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedIn Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt. Cursor 
MCP SDKs & servers 2025-08 35. CVE-2025-8217: malicious code shipped in Amazon Q Developer 1.84.0An over-scoped GitHub token in Amazon Q’s build setup let an attacker commit malicious code that shipped in the VS Code extension 1.84.0. AWS says it failed to run due to a syntax error. 
Amazon Q Developer 2025-07-23 36. Supabase MCP: a support ticket gets the agent to dump private tablesGeneral Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role. MCP SDKs & servers 
Supabase Cursor +1 more 2025-07-08 37. AI agent deleted a production database during a code freeze (Replit)Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible. 
Replit Cursor 2025-07 38. CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary originsClaude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when visiting attacker-controlled webpages. Claude Code 2025-06-23 39. GitHub MCP server: a public issue makes the agent leak private reposInvariant Labs showed that a prompt injection planted in a public GitHub issue could get an agent using the official GitHub MCP server to pull data from the user’s private repositories. MCP SDKs & servers Claude Code Cursor +1 more 2025-05-26 40. MCP tool poisoning: hidden instructions in tool descriptionsAn MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere. MCP SDKs & servers Cursor Claude Code +2 more 2025-04-01 41. “Rules File Backdoor”: hidden Unicode instructions in AI rules filesPillar Security showed invisible Unicode characters in shared rules files (.cursorrules, .mdc) can steer Cursor and GitHub Copilot into writing backdoored code. Cursor Copilot 2025-03 42. Authentication logic living entirely in the browserHiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly. Lovable 
Base44 Bolt +3 more 2025 43. Slopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. Claude Code Copilot Cursor +5 more 2025 44. Protecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. Next.js v0 Bolt +2 more 2025-03
Lovable Bolt v0 +4 more 2026-08 02. Supabase service_role / secret key shipped to the browserThe service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public. Lovable Bolt v0 +4 more 2026-08 03. CVE-2026-12537: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypassesGemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. Gemini CLI 2026-04-24 04. CVE-2025-61260: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration filesA vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex CLI 2026-04-14 05. CamoLeak: Copilot Chat leaked private source codeLegit Security reported a critical vulnerability in GitHub Copilot Chat that could leak private source code from a user’s repositories. Copilot 2025-10-08 06. CVE-2025-32711 (EchoLeak): zero-click data leak in Microsoft 365 CopilotAI command injection in Microsoft 365 Copilot let an unauthorised attacker disclose information over a network. Microsoft fixed it server-side. Copilot 2025-06-11 07. CVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. Next.js v0 Bolt +2 more 2025-03 08. CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningThe plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. Claude Code 2026-10-15 09. Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. Lovable Bolt v0 +4 more 2026-08 10. CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionClaude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. Claude Code 2026-07-24 11. CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code ExecutionClaude Code used the git worktree commondir file when determining folder trust but did not validate its contents. Claude Code 2026-04-24 12. CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceClaude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. Claude Code 2026-04-21 13. CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings FileClaude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. Claude Code 2026-03-19 14. CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.jsonClaude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. Claude Code 2026-02-06 15. CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write RestrictionsClaude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Claude Code 2026-02-06 16. CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write ProtectionClaude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Claude Code 2026-02-06 17. CVE-2026-24887: Claude Code has a Command Injection in find Command Bypasses User Approval PromptDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Claude Code 2026-02-03 18. CVE-2026-24053: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File WritesDue to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Claude Code 2026-02-03 19. CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled DomainsClaude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. Claude Code 2026-02-03 20. CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code ExecutionDue to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-12-03 21. CVE-2025-64755: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File WritesDue to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. Claude Code 2025-11-20 22. CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialogWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-11-19 23. CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialogDue to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Claude Code 2025-10-03 24. CVE-2025-59828: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn VersionsWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-09-24 25. CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logicDue to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. Codex CLI 2025-09-19 26. CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git emailAt startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace. Claude Code 2025-09-10 27. CVE-2025-58764: Claude Code rg vulnerability does not protect against approval prompt bypassDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-09-10 28. Windsurf: prompt injection leaks developer secretsEmbrace The Red showed how prompt injection in files the Cascade agent reads could get Windsurf to leak secrets from the developer’s machine. Windsurf 2025-08-21 29. CVE-2025-55284: Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude CodeDue to an overly broad allowlist of safe commands, it was possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation. Claude Code 2025-08-18 30. CVE-2025-53773: GitHub Copilot prompt injection to code executionCommand injection in GitHub Copilot and Visual Studio let an attacker run code on a developer’s machine. Embrace The Red showed it starting from a prompt injection in project content. Copilot 2025-08-12 31. CVE-2025-54795: Claude Code echo command allowed bypass of user approval prompt for command executionDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-08-04 32. CVE-2025-54794: Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file accessDue to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Claude Code 2025-08-04 33. CVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeBefore 1.3.9, Cursor let the agent create new dotfiles like .cursor/mcp.json without approval. Chained with prompt injection, this meant remote code execution. Cursor 2025-08 34. CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedIn Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt. Cursor MCP SDKs & servers 2025-08 35. CVE-2025-8217: malicious code shipped in Amazon Q Developer 1.84.0An over-scoped GitHub token in Amazon Q’s build setup let an attacker commit malicious code that shipped in the VS Code extension 1.84.0. AWS says it failed to run due to a syntax error. Amazon Q Developer 2025-07-23 36. Supabase MCP: a support ticket gets the agent to dump private tablesGeneral Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role. MCP SDKs & servers Supabase Cursor +1 more 2025-07-08 37. AI agent deleted a production database during a code freeze (Replit)Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible. Replit Cursor 2025-07 38. CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary originsClaude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when visiting attacker-controlled webpages. Claude Code 2025-06-23 39. GitHub MCP server: a public issue makes the agent leak private reposInvariant Labs showed that a prompt injection planted in a public GitHub issue could get an agent using the official GitHub MCP server to pull data from the user’s private repositories. MCP SDKs & servers Claude Code Cursor +1 more 2025-05-26 40. MCP tool poisoning: hidden instructions in tool descriptionsAn MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere. MCP SDKs & servers Cursor Claude Code +2 more 2025-04-01 41. “Rules File Backdoor”: hidden Unicode instructions in AI rules filesPillar Security showed invisible Unicode characters in shared rules files (.cursorrules, .mdc) can steer Cursor and GitHub Copilot into writing backdoored code. Cursor Copilot 2025-03 42. Authentication logic living entirely in the browserHiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly. Lovable Base44 Bolt +3 more 2025 43. Slopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. Claude Code Copilot Cursor +5 more 2025 44. Protecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. Next.js v0 Bolt +2 more 2025-03