Claude Code CVE Database

mcp-remote

mcp-remote was exposed to OS command injection when connecting to untrusted MCP servers, through crafted input in the authorization_endpoint response URL.

Fixed in

0.1.16

Mitigation

Update mcp-remote to 0.1.16 or later and connect only to trusted MCP servers. A later monitoring record (CVE-2026-108716) covers 0.8.0 through 0.14.3, so 0.1.16 is not a current floor.

Source: https://github.com/advisories/GHSA-6xpm-ggf7-wc3p

anthropics/claude-code-action

The action checked out attacker-controlled PR head branches, read .mcp.json from the working directory and enabled all project MCP servers. A pull request carrying a malicious .mcp.json could run code on the Actions runner and expose workflow secrets when a privileged user triggered the action on that PR.

Fixed in

1.0.74

Mitigation

Update claude-code-action to 1.0.74 or later and do not trigger it on untrusted pull requests with secrets in scope.

Source: https://github.com/anthropics/claude-code-action/security/advisories/GHSA-8q5r-mmjf-575q

OpenAI Codex CLI

Codex CLI 0.23.0 and earlier loaded project-local .env and .codex/config.toml files without confirmation when run inside a repository, so a malicious repository could embed commands that executed immediately through MCP configuration.

Fixed in

Unknown

Mitigation

Use a Codex CLI release later than 0.23.0 and inspect .codex/ and .env before running Codex in an untrusted repository. The advisory lists no patched version.

Source: https://github.com/advisories/GHSA-xrxf-jgv3-qmrm

GitHub Copilot CLI shell tool

The shell safety assessment classified commands using bash parameter transformation operators as read-only. An attacker who could influence agent commands, for example through repository files or MCP server responses, could execute hidden commands.

Fixed in

0.0.423

Mitigation

Update Copilot CLI to 0.0.423 or later.

Source: https://github.com/github/copilot-cli/security/advisories/GHSA-g8r9-g2v8-jv6f

Cursor IDE

Case-sensitive checks protecting sensitive files such as .cursor/mcp.json let a prompt injection modify them on case-insensitive filesystems and reach remote code execution.

Fixed in

1.7

Mitigation

Update Cursor to 1.7 or later. The advisory lists affected versions below 1.6.23 and 1.7 as patched.

Source: https://github.com/cursor/cursor/security/advisories/GHSA-xcwh-rrwj-gxc7

Cursor IDE workspaces

A prompt injection that hijacked chat context could write workspace settings into a .code-workspace file and turn them into code execution.

Fixed in

1.7

Mitigation

Update Cursor to 1.7 or later.

Source: https://github.com/cursor/cursor/security/advisories/GHSA-xg6w-rmh5-r77r

Cursor Agent CLI

When MCP used OAuth with an untrusted server, the server could return crafted commands during the exchange and reach command injection on the host with the user's privileges.

Fixed in

2025.09.17-25b418f

Mitigation

Update Cursor CLI to 2025.09.17-25b418f or later and use OAuth only with trusted MCP servers.

Source: https://github.com/cursor/cursor/security/advisories/GHSA-wj33-264c-j9cq

Cursor MCP server deep-link install

A crafted MCP install deep-link bypassed the warning dialog and showed a trusted server name while running arbitrary commands from the link if the user accepted.

Fixed in

2.0

Mitigation

Update Cursor to 2.0 or later and do not accept MCP install links from untrusted sources.

Source: https://github.com/cursor/cursor/security/advisories/GHSA-4575-fh42-7848

Cursor CLI (Beta)

Opening a cloned repository with Cursor CLI ran the command of a malicious MCP server declared in .cursor/mcp.json without any warning.

Fixed in

2025.09.17-25b418f

Mitigation

Update Cursor CLI to 2025.09.17-25b418f or later; MCP servers now prompt before being enabled.

Source: https://github.com/cursor/cursor/security/advisories/GHSA-4hwr-97q3-37w2

Zed IDE

Zed loaded MCP context server definitions from a project's .zed/settings.json, so opening a crafted project ran arbitrary commands with the user's privileges without further interaction.

Fixed in

v0.218.2-pre

Mitigation

Use a Zed release that includes the worktree trust mechanism from v0.218.2-pre and review .zed/settings.json before opening untrusted projects.

Source: https://github.com/zed-industries/zed/security/advisories/GHSA-cv6g-cmxc-vw8j

MCP Python SDK streamable HTTP transport

A client that deliberately triggered an exception after opening a streamable HTTP session could cause an uncaught ClosedResourceError and crash the server until restart.

Fixed in

1.10.0

Mitigation

Update mcp to 1.10.0 or later; the existing 1.30.0 floor covers it.

Source: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-j975-95f5-7wqh

MCP Python SDK FastMCP server

Malformed requests could trigger an unhandled validation exception and leave the server returning 500 errors until manually restarted.

Fixed in

1.9.4

Mitigation

Update mcp to 1.9.4 or later; the existing 1.30.0 floor covers it.

Source: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-3qhf-m339-9g5v

MCP TypeScript SDK HTTP transports

HTTP-based servers did not enable DNS rebinding protection by default. A localhost server without authentication could receive requests from a malicious website and run tools or read resources on the user's behalf.

Fixed in

1.24.0

Mitigation

Update @modelcontextprotocol/sdk to 1.24.0 or later, or enable enableDnsRebindingProtection, and authenticate local HTTP servers.

Source: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-w48q-cv73-mx4w

MCP Go SDK

The SDK parsed JSON-RPC with encoding/json, which matches keys case-insensitively and folds some Unicode characters. A malicious peer could send protocol messages with non-standard field names that the SDK still accepted, contrary to JSON-RPC 2.0.

Fixed in

1.3.1

Mitigation

Update the Go SDK to 1.3.1 or later; the existing 1.4.0 floor covers it.

Source: https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f

MCP Java SDK servlet transports

The servlet SSE and streamable HTTP transports sent Access-Control-Allow-Origin: *, so a page in the victim's browser could read responses from a reachable MCP server.

Fixed in

0.x: 0.18.3; 1.0.x: 1.0.1; 1.1.x: 1.1.1

Mitigation

Update mcp-core to 1.1.1, 1.0.1 or 0.18.3 on its branch.

Source: https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-hv2w-8mjj-jw22

MCP Inspector

The Inspector rendered a redirect URL returned by a remote MCP server. A crafted redirect could inject script and, through the built-in proxy, run commands on the developer machine.

Fixed in

0.16.6

Mitigation

Update the Inspector to 0.16.6 or later and connect it only to trusted servers.

Source: https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-g9hg-qhmf-q45m

FastMCP OAuth client callback page

The callback page served during the client OAuth flow embedded request values such as the error parameter without escaping, allowing reflected cross-site scripting.

Fixed in

2.13.0

Mitigation

Update fastmcp to 2.13.0 or later.

Source: https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-mxxr-jv3v-6pgc

FastMCP install cursor

fastmcp install cursor placed the server name in a deep-link opened through cmd.exe on Windows, so shell metacharacters in an influenced server name ran arbitrary commands.

Fixed in

2.13.0

Mitigation

Update fastmcp to 2.13.0 or later and install only servers you trust.

Source: https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5

FastMCP OAuth Proxy

The OAuth Proxy ignored the client's resource parameter and issued tokens for its base_url, so a token obtained for one MCP server could be accepted by another behind the same proxy.

Fixed in

2.14.2

Mitigation

Update fastmcp to 2.14.2 or later.

Source: https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-5h2m-4q8j-pqpj

FastMCP install claude-code / gemini-cli

On Windows the target CLIs often resolve to .cmd wrappers run through cmd.exe, so metacharacters in a server name passed to fastmcp install claude-code or gemini-cli ran commands.

Fixed in

3.2.0

Mitigation

Update fastmcp to 3.2.0 or later; the existing 3.4.10 floor covers it.

Source: https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g

GitHub MCP Server

A completion/complete request without a ref field dereferenced nil and crashed the server before authentication, letting any client cause a denial of service.

Fixed in

1.1.0

Mitigation

Update the GitHub MCP Server to 1.1.0 or later.

Source: https://github.com/github/github-mcp-server/security/advisories/GHSA-w4q6-qw23-4rg7

MCP Registry API

The trailing-slash middleware redirected //evil.com/ to //evil.com, which browsers treat as an external URL.

Fixed in

1.7.5

Mitigation

Update self-hosted registries to 1.7.5 or later.

Source: https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-v8vw-gw5j-w7m6

@modelcontextprotocol/server-slack (deprecated)

The unreviewed advisory states that an agent using Anthropic's deprecated Slack MCP server could be led by untrusted data to post links embedding private data, which Slack preview bots then fetched from the attacker's URL without user interaction. No fixed version is listed.

Fixed in

Unknown

Mitigation

Remove the deprecated Slack MCP server or disable link unfurling for agent-posted messages. No fixed version was found on 2026-11-03.

Source: https://github.com/advisories/GHSA-gmx5-crwh-6vxg

OpenAI Codex CLI and Codex Desktop

The unreviewed advisory states that Codex treated some PowerShell commands using --% as safe, so an attacker-prepared repository could get a file-writing Git command run without approval and alter Codex configuration to launch an attacker MCP server. The default macOS and Linux filesystem sandbox can block the write. The advisory links a fix pull request but no version.

Fixed in

Unknown

Mitigation

Keep the filesystem sandbox enabled and update Codex. No fixed version was listed on 2026-11-03.

Source: https://github.com/advisories/GHSA-2frj-4qr5-m2rf

Z.ai ZCode

The CVE record states that ZCode v3.11.2.6792 automatically connected to MCP servers declared in a repository workspace configuration, possibly allowing code execution when a crafted repository is opened.

Fixed in

Unknown

Mitigation

Do not open untrusted repositories in ZCode and review workspace MCP configuration first. No vendor advisory or fixed version was found on 2026-11-02.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-88755

MCP Kotlin SDK WebSocket server

The CVE record states that Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit, so clients can force near 2 GiB allocations.

Fixed in

Unknown

Mitigation

Set a WebSocket maxFrameSize or terminate WebSockets behind a size-limiting proxy. No maintainer advisory or fixed version was found on 2026-11-02.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-108714

mcp-go Streamable HTTP server

The CVE record states that StreamableHTTPServer.ServeHTTP reads POST bodies with io.ReadAll before validation, so unauthenticated clients can exhaust memory.

Fixed in

Unknown

Mitigation

Cap request body size in front of the server. No maintainer advisory or fixed version was found on 2026-11-02.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-108859

mcp-remote device-code OAuth flow

The CVE record states that authorizeWithDeviceCode sends the client secret and receives tokens over non-loopback http device authorization and token endpoints.

Fixed in

Unknown

Mitigation

Use only https authorization servers. No maintainer advisory or fixed version was found on 2026-11-02.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-108716

Claude Code file writes

Claude Code checked that a target path was inside the project at permission time but re-resolved it at write time. An attacker with write access to a shared workspace who won the race could swap a project file for a symlink and redirect the write outside the project.

Fixed in

2.1.129

Mitigation

Update Claude Code to 2.1.129 or later; auto-update already delivers the fix. Avoid shared writable workspaces between differently privileged sessions.

Source: https://github.com/anthropics/claude-code/security/advisories/GHSA-5j29-h97v-84ch

Claude Code and Claude Desktop plugin install

The plugin install flow ran git checkout on a pinned commit SHA without checking that HEAD matched it. A plugin upstream could create a branch named like the 40-character SHA so the install resolved to attacker-controlled code.

Fixed in

2.1.179

Mitigation

Update Claude Code to 2.1.179 or later; auto-update already delivers the fix. Exploitation required a malicious plugin source on a git host that allows SHA-shaped branch names.

Source: https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv

Claude Desktop (Windows)

Claude Desktop on Windows launched git.exe without an absolute path, so the current working directory was searched first. A git.exe placed in a project directory ran when the user opened that directory.

Fixed in

1.8089.0

Mitigation

Update Claude Desktop to 1.8089.0 or later; auto-update already delivers the fix. Do not open untrusted repositories containing executables on older Windows builds.

Source: https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84

Claude Code Edit tool (macOS sandbox)

Edit targets were validated with point-in-time path resolution. On macOS, code running inside the Bash sandbox could swap an in-workspace parent directory for a symlink after validation, making the unsandboxed Edit write a user-writable file outside the workspace.

Fixed in

2.1.251

Mitigation

Update Claude Code to 2.1.251 or later; auto-update already delivers the fix. Exploitation required attacker-controlled code in the sandbox, such as a malicious repository or dependency script.

Source: https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv

claude-agent-sdk (Python)

The SDK passed the resume option to the Claude CLI without validation. A value starting with a dash could inject --mcp-config with a stdio MCP server and run a command at CLI startup, bypassing the SDK permission controls.

Fixed in

0.2.121

Mitigation

Upgrade claude-agent-sdk to 0.2.121 or later. Never pass untrusted input as the session ID to resume.

Source: https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm

MCP Python SDK server bearer authentication

Server bearer authentication could not check a token's audience. Where one authorization server issues tokens for several services, a token for another service was accepted.

Fixed in

1.x: 1.30.0; 2.x: 2.2.0

Mitigation

Upgrade to mcp 1.30.0 or 2.2.0, then set validate_token_resource=True with resource_server_url and return the audience as AccessToken.resource. Upgrading alone changes nothing.

Source: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23

MCP TypeScript SDK HTTP server transports

HTTP-reachable servers did not limit POST body size or JSON-RPC batch length, so large requests could exhaust memory and one long batch could block the server. stdio servers are excluded.

Fixed in

sdk 1.x: 1.30.1; server and node 2.x: 2.1.0; hono: 2.0.1

Mitigation

Upgrade every installed package to its fixed version; bodies over 4 MiB then get 413 and batches over 100 messages get 400. Until then, cap request size in a reverse proxy; express.json() does not limit batch length.

Source: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-f897-62hf-6gxq

MCP TypeScript SDK server (2.x)

Messages were matched to connections by JSON-RPC id alone. When clients shared one stateless transport or one server instance, one client's responses and notifications could reach another client.

Fixed in

2.3.0

Mitigation

Upgrade @modelcontextprotocol/server to 2.3.0 and build a new server and transport per request or session; shared instances now fail with ALREADY_CONNECTED.

Source: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp

MCP TypeScript SDK input validation

Servers did not limit how many array elements and object keys they validated in one request, so one HTTP request inside the default 4 MiB limit could exhaust the heap.

Fixed in

sdk 1.x: 1.32.0; server 2.x: 2.3.0

Mitigation

Upgrade, then set maxToolInputElements and lower the request size limit; the option is off by default, so upgrading alone changes nothing.

Source: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453

MCP TypeScript SDK server bearer authentication

requireBearerAuth() and verifyBearerToken() could not check a token's audience, so a token issued for another service by the same authorization server was accepted.

Fixed in

sdk 1.x: 1.32.0; server 2.x: 2.3.0; express: 2.0.2; server-legacy: 2.3.1

Mitigation

Upgrade, then pass expectedResource and return the token audience from verifyAccessToken(); the setting is off by default, so upgrading alone changes nothing.

Source: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq

FastMCP server transforms

Direct lookups checked the original component's authorization policy but returned the transformed component without rechecking it, so a client knowing the identifier could call a denied tool or read a denied resource or prompt.

Fixed in

3.x: 3.4.10; 4.x: 4.1.2

Mitigation

Upgrade fastmcp or fastmcp-slim to 3.4.10 or 4.1.2 or later.

Source: https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-7xgj-8392-5q4r

FastMCP OAuth client credentials providers

The client credentials and private-key JWT providers did not bind pre-registered credentials to their issuer, so an untrusted MCP server could advertise another authorization server and receive the client secret or a signed assertion.

Fixed in

4.1.2

Mitigation

Upgrade to 4.1.2, which adds issuer to ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider and requires MCP SDK 2.2.0. 3.x does not include these wrappers.

Source: https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-vqqp-x5qm-5qp4

@sylphx/pdf-reader-mcp HTTP transport

With MCP_TRANSPORT=http the server logged that API key authentication was enabled but never checked X-API-Key. Bound to 0.0.0.0 by default, it let any reachable client call every tool and read any PDF the process could open.

Fixed in

3.0.1

Mitigation

Upgrade to 3.0.1 or later. Until then use the default stdio transport or bind HTTP to loopback.

Source: https://github.com/SylphxAI/anymd/security/advisories/GHSA-q344-5v34-gm84

mcp-sanitizer URL sanitizer

The URL sanitizer did not block localhost with an explicit port or bracketed IPv6 loopback and link-local addresses, so URLs passed to MCP fetch tools could reach internal services.

Fixed in

1.4.0

Mitigation

Upgrade mcp-sanitizer to 1.4.0 or later and do not rely on it as the only egress control for fetch tools.

Source: https://github.com/starman69/mcp-sanitizer/security/advisories/GHSA-4mfg-r38w-w8fg

mcp-sanitizer file path sanitizer

The file path sanitizer allowlisted /home/ and /Users/ absolute prefixes, so paths to SSH keys or cloud credentials outside the configured safe roots were reported as not blocked.

Fixed in

1.4.0

Mitigation

Upgrade mcp-sanitizer to 1.4.0 or later and enforce safe roots in the file tool itself.

Source: https://github.com/starman69/mcp-sanitizer/security/advisories/GHSA-7w82-6f9j-v9jp

SiYuan MCP file tool

The MCP file tool blocked only conf/conf.json while the HTTP file API also blocks snippet configuration, templates and publish access data, exposing publish-mode passwords and other sensitive workspace files.

Fixed in

3.8.0

Mitigation

Update SiYuan to 3.8.0 or later; the existing siyuan floor of 3.8.1 already covers it.

Source: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34

Envoy AI Gateway / agent-router MCP proxy

Session IDs embedded the caller's JWT subject but resume never compared it with the current caller. The Helm chart also shipped a public default seed, making session IDs forgeable.

Fixed in

1.2.0-rc1

Mitigation

Upgrade to 1.2.0-rc1 or later and replace the default-insecure-seed value with a secret seed.

Source: https://github.com/theagentrouter/agent-router/security/advisories/GHSA-953h-535j-jg2v

@aborruso/ckan-mcp-server MCP Apps UI

The DataStore table UI accepted postMessage data without checking event.origin and sent its JSON-RPC messages with target origin '*'.

Fixed in

0.4.112

Mitigation

Upgrade @aborruso/ckan-mcp-server to 0.4.112 or later.

Source: https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-vqff-r82h-9crc

nginx-ui MCP endpoints

Configuration mutation over HTTP required a secure OTP session, but /mcp and /mcp_message only required ordinary authentication and exposed nginx_config_add and nginx_config_modify.

Fixed in

2.4.1

Mitigation

Upgrade nginx-ui to 2.4.1 or later; restrict MCP endpoints to trusted users until then.

Source: https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-vc32-4gwf-77xp

nginx-ui MCP nginx_config_add

nginx_config_add wrote configuration and reloaded nginx without ValidateConfigFile, unlike the REST API, so an authenticated caller could add blocked directives such as perl or js_import.

Fixed in

2.4.1

Mitigation

Upgrade nginx-ui to 2.4.1 or later. Same root cause as CVE-2026-84317 and CVE-2026-84319.

Source: https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-9jww-cxg5-rj9m

nginx-ui MCP nginx_config_add

One of four configuration write paths, the MCP nginx_config_add tool, did not call the directive blocklist, so an authenticated caller or a prompt-injected agent could reach nginx code execution where njs or perl modules are available.

Fixed in

2.4.1

Mitigation

Upgrade nginx-ui to 2.4.1 or later. Same root cause as CVE-2026-84318 and CVE-2026-84319.

Source: https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr

nginx-ui MCP configuration tools

A secondary authenticated user could write restricted directives through the MCP interface, load the njs module and execute attacker-controlled NJS in the nginx worker. The advisory states this is not OS command execution by itself.

Fixed in

2.4.1

Mitigation

Upgrade nginx-ui to 2.4.1 or later. Same root cause as CVE-2026-84317 and CVE-2026-84318.

Source: https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5r62-gj48-897x

Langflow MCP stdio transport

The MCP stdio transport launched any command and arguments placed in an MCP server configuration, without an allowlist. Users able to edit MCP server settings or build a flow with MCP Tools could run OS commands on the Langflow host.

Fixed in

langflow 1.10.3; langflow-base 0.10.3; lfx 1.10.3

Mitigation

Upgrade to Langflow 1.10.3 or later and disable LANGFLOW_AUTO_LOGIN on reachable instances.

Source: https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45

Langflow project-scoped MCP resources

The project MCP transport authenticated the caller for its project but resources/read did not authorize the requested URI, so a user could read files from other users' flows.

Fixed in

1.9.1

Mitigation

Upgrade Langflow to 1.9.1 or later; 1.10.3 also fixes CVE-2026-105697.

Source: https://github.com/langflow-ai/langflow/security/advisories/GHSA-4hmc-cfm3-w43c

PraisonAI MCP HTTP-stream server

praisonai mcp serve --transport http-stream defaulted to no API key, exposing initialize and tools/list without authentication, and tool arguments were not checked against inputSchema. The advisory says workflow execution and file read were refuted on 4.6.63.

Fixed in

4.6.78

Mitigation

Upgrade praisonai to 4.6.78 or later and set --api-key on any HTTP-stream deployment.

Source: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hc5v-gxvj-58wh

@payloadcms/plugin-mcp

Under certain conditions an authenticated user could manage MCP API keys outside their account and take over other accounts. Applications without the MCP plugin are not affected.

Fixed in

3.88.0

Mitigation

Upgrade @payloadcms/plugin-mcp to 3.88.0 or later, or disable the plugin or restrict MCP key management to trusted users.

Source: https://github.com/payloadcms/payload/security/advisories/GHSA-2q76-m6w6-qgc6

obsidian-tc MCP Streamable HTTP server

On Streamable HTTP with jwtSecret set, a destructive tool call that asked for elicitation confirmation could still complete after the human declined, cancelled or omitted the answer, because the server treated a valid requestState as approval.

Fixed in

1.31.4

Mitigation

Upgrade obsidian-tc to 1.31.4 or later.

Source: https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-737x-cwfr-5vvc

djust MCP find_handlers_for_template tool

The find_handlers_for_template MCP tool accepted any absolute filesystem path and read the file.

Fixed in

1.0.10; 1.1.7; 1.2.4; 1.3.0rc8

Mitigation

Upgrade djust to the fixed release of its branch.

Source: https://github.com/djust-org/djust/security/advisories/GHSA-r57g-mc79-8hj2

Next.js dev server MCP endpoint

next dev exposed an MCP endpoint that did not verify the requesting origin, so a website visited by the developer could read the project path, source snippets, routes and development logs. Production deployments do not serve it.

Fixed in

16.3.8

Mitigation

Upgrade Next.js to 16.3.8 or later.

Source: https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv

chrome-devtools-mcp file output

Output paths were checked against MCP roots before the file extension was rewritten, so an in-root symlink with the rewritten name could make tools overwrite a file outside the roots.

Fixed in

1.5.0

Mitigation

Upgrade chrome-devtools-mcp to 1.5.0 or later. The advisory states this is not remote code execution.

Source: https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-5hw5-4q87-m6x9

JetBrains Junie CLI

The vendor CVE record states that code execution was possible via an untrusted project's MCP server configuration.

Fixed in

26.8.3

Mitigation

Update Junie CLI to 26.8.3 or later and review workspace MCP configuration before opening untrusted projects.

Source: https://www.cve.org/CVERecord?id=CVE-2026-111091

Cline Hub dashboard (/browser endpoint)

The local dashboard accepted browser WebSocket connections without Origin validation when ROOM_SECRET was unset. Such clients could alter MCP or provider settings and trigger agent commands when a provider and model were configured.

Fixed in

Unknown

Mitigation

Do not expose the affected dashboard to untrusted browser origins. The reviewed upstream advisory lists no patched version; verify upstream remediation before re-enabling affected use.

Source: https://github.com/cline/cline/security/advisories/GHSA-3cj3-hqcr-g934

MCP TypeScript SDK HTTP client transports

HTTP transports and OAuth requests forwarded custom headers and session IDs across origins; 307/308 redirects also re-sent bodies containing OAuth credentials. Current fetch runtimes already remove the Authorization header.

Fixed in

sdk 1.x: 1.32.0; client 2.x: 2.3.0

Mitigation

Upgrade sdk to 1.32.0 or client to 2.3.0. Configure final URLs and avoid redirectPolicy: follow, which restores exposure; stdio clients are excluded.

Source: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw

MCP TypeScript SDK experimental tasks

HTTP clients sharing an InMemoryTaskStore could list, read or cancel tasks created by other sessions. Exposure requires a configured taskStore; 2.x packages are excluded.

Fixed in

1.32.0

Mitigation

Upgrade @modelcontextprotocol/sdk to 1.32.0 or later. Prefer removing deprecated experimental tasks; otherwise use a separate InMemoryTaskStore per session until patched.

Source: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw

MCP TypeScript SDK OAuth client

OAuth credentials were not bound to the authorization server that owned them. An untrusted MCP server could redirect saved refresh tokens, client secrets or signed assertions to another issuer.

Fixed in

sdk 1.x: 1.31.0; client 2.x: 2.2.0

Mitigation

Upgrade sdk to 1.31.0 or client to 2.2.0; update directly imported core to 2.2.0. Set expectedIssuer on bundled providers and add issuer to or clear unbound saved credentials. Custom providers must preserve issuer. Direct refreshAuthorization/exchangeAuthorization and skipIssuerMetadataValidation remain outside the fix.

Source: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h

awslabs.security-agent-mcp-server

A caller-influenced diff revision could be interpreted as a Git option, allowing writes outside the workspace within server-process privileges. Repository-influenced output could lead to execution; the operation could report no diff.

Fixed in

0.2.0

Mitigation

Upgrade awslabs.security-agent-mcp-server to 0.2.0 or later. Before upgrading, limit diff scans to trusted repositories and run the server with least privilege in isolation.

Source: https://github.com/awslabs/mcp/security/advisories/GHSA-8g28-rj54-p5p2

MCP Python SDK HTTP client transports

HTTP client transports and OAuth requests followed cross-origin redirects carrying custom headers and, for 307/308, request bodies. The HTTP library dropped a lone Authorization header across origins.

Fixed in

1.x: 1.30.0; 2.x: 2.2.0

Mitigation

Upgrade mcp to 1.30.0 or 2.2.0 on the corresponding branch. Configure final endpoint URLs; before upgrading, supply an HTTP client with follow_redirects=False. Rotate credentials that reached untrusted redirect targets.

Source: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-5h93-6whr-6q8j

MCP Python SDK HTTP server and OAuth endpoints

HTTP transports and OAuth routes read request bodies without a shared size limit. Streamable HTTP received an earlier partial limit; the later fix covered SSE message and OAuth routes.

Fixed in

1.x: 1.29.1; 2.x: 2.1.0

Mitigation

Upgrade to mcp 1.29.1 or 2.1.0 on the corresponding branch, or enforce a body cap before the SDK. Direct StreamableHTTPServerTransport use still requires an external limit.

Source: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc

MCP Python SDK Streamable HTTP server

Default stateful Streamable HTTP sessions retained initialize payloads without bounded session counts or reclamation, including ended or refused sessions. Reachable clients could exhaust server memory.

Fixed in

1.x: 1.30.0; 2.x: 2.2.0

Mitigation

Upgrade mcp to 1.30.0 or 2.2.0 on the corresponding branch. Tune max_sessions, session_idle_timeout and request-body limits. stateless_http=True on 1.12.0 or later avoids session retention.

Source: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-84m7-p3x7-pcfv

MCP Python SDK OAuth client

An untrusted MCP server could select where an OAuth client sent credentials because issuer validation and credential binding were incomplete. stdio clients, clients attaching their own headers and SDK servers are excluded.

Fixed in

1.x: 1.30.0; 2.x: 2.2.0

Mitigation

Upgrade mcp to 1.30.0 or 2.2.0 on the corresponding branch. Pass issuer= for ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider; clear or bind stored unbound registrations. Migrate RFC7523OAuthClientProvider. Rotate exposed secrets and revoke tokens when past exposure is plausible.

Source: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-qx49-fqc8-xw99

MCP Python SDK (mcp on PyPI)

Tool output-schema validation resolved server-chosen external references through synchronous URL or local-file reads without a timeout. Retrieved content was used as a schema and was not returned to the server; a stalled fetch could block the event loop.

Fixed in

1.x: 1.30.0; 2.x: 2.2.0

Mitigation

Upgrade mcp to 1.30.0 on 1.x or 2.2.0 on 2.x. Until then, call tools only on trusted servers.

Source: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-rwrf-2pqf-9j8j

Claude Code server-managed settings

A stored API key was preferred when fetching server-managed settings despite Enterprise or Team session sign-in. Rejection could leave no server policy or an older cached copy; endpoint-managed settings were unaffected.

Fixed in

2.1.260

Mitigation

Upgrade Claude Code to 2.1.260 or later; verify server-managed policy refresh on affected devices.

Source: https://github.com/anthropics/claude-code/security/advisories/GHSA-gfvf-j8jh-jxxw

Claude Desktop (macOS Cowork)

An omitted executable file type allowed content from a Cowork shared folder to run commands on macOS when opened from Claude Desktop. A separate guest-kernel flaw could remove the user-interaction requirement on older VM images.

Fixed in

1.15962.0

Mitigation

Upgrade Claude Desktop to 1.15962.0 or later. The guest-kernel fix shipped separately in 1.11847.5.

Source: https://github.com/anthropics/claude-code/security/advisories/GHSA-v234-4jrq-mgg6

Sentry Seer autonomous coding-agent handoff

CERT/CC describes untrusted public-DSN events becoming coding-agent instructions when automatic remediation is enabled, leading to execution in the agent environment and access to connected repositories.

Fixed in

Unknown

Mitigation

Pause automatic coding-agent handoff, restrict package installation and scope repository credentials while awaiting vendor remediation.

Source: https://www.kb.cert.org/vuls/id/212479

Claude Code, Codex, GitHub Copilot and Gemini CLI

AIR reports plugin checkout can resolve an attacker-controlled default branch instead of the reviewed commit. The SHA-shaped branch variant depends on Git host rules; Gemini uses a FETCH_HEAD variant.

Fixed in

Claude Code 2.1.179; Codex 0.146.0; no Copilot or Gemini floor established

Mitigation

AIR reports fixes in Claude Code 2.1.179 and Codex 0.146.0. For other affected installers, verify current vendor guidance or disable affected plugin updates.

Source: https://www.air.security/blog-posts/plugin4shell

Codex Desktop node_repl

Accomplish reported that a Desktop-installed JavaScript helper exposed a privileged trust token within shared memory, enabling host execution even in read-only mode. The researcher identifies Desktop build 26.818.21641 as fixed.

Fixed in

26.818.21641

Mitigation

Update Codex Desktop to build 26.818.21641 or later; a CLI-only update does not establish that the Desktop helper is patched.

Source: https://www.accomplish.ai/blog/escaping-the-openai-codex-sandbox-twice/

Codex CLI

Accomplish reported that attacker-controlled patch paths could expand write authorization beyond the Codex workspace. The researcher identifies CLI 0.149.0 as fixed.

Fixed in

0.149.0

Mitigation

Update Codex CLI to 0.149.0 or later.

Source: https://www.accomplish.ai/blog/escaping-the-openai-codex-sandbox-twice/

Claude Code

Releases through 2.1.281 correct symlink write checks, workspace trust before background hooks, inherited setting restrictions, NUL permission rules and managed MCP handling.

Fixed in

2.1.281 includes the reviewed fixes

Mitigation

Update Claude Code to 2.1.281 or later and review trust, permission and managed MCP settings.

Source: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

@zereight/mcp-gitlab

GraphQL operations can bypass read-only and project filters. Other findings concern deployment-dependent transport authentication, session exhaustion and untrusted CI logs.

Fixed in

2.1.30

Mitigation

Update @zereight/mcp-gitlab to 2.1.30 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-5648-rgj9-v224

@zereight/mcp-gitlab

Streamable HTTP accepts attacker-origin browser traffic at initialization. In remote-authorization mode, tool listing and GitLab calls still require a token; the advisory does not establish a tokenless takeover in that mode.

Fixed in

2.1.30

Mitigation

Update @zereight/mcp-gitlab to 2.1.30 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-vmp7-252j-cwp7

@zereight/mcp-gitlab

With ENABLE_DYNAMIC_API_URL=true, an HTTP caller can redirect credential-bearing GitLab requests through X-GitLab-API-URL to an untrusted destination.

Fixed in

2.1.27

Mitigation

Update @zereight/mcp-gitlab to 2.1.27 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-2h44-8472-frjj

@zereight/mcp-gitlab

An exposed SSE transport and unrestricted upload_markdown path can disclose server-readable files, including GitLab tokens, to a reachable GitLab project.

Fixed in

2.1.27

Mitigation

Update @zereight/mcp-gitlab to 2.1.27 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-cv3r-c5h8-f4g5

github.com/stacklok/toolhive

A compromised MCP container using the default permissive network profile can reach host services and unauthenticated ToolHive control endpoints without escaping the container.

Fixed in

CLI 0.30.1; Studio 0.38.0

Mitigation

Update CLI to 0.30.1 or later and Studio to 0.38.0 or later; restrict MCP container access to host services.

Source: https://github.com/advisories/GHSA-qg2g-g9w3-m5h8

github.com/f1bonacc1/process-compose

When MCP SSE is enabled, browser DNS rebinding can reach Process Compose tools. The separate REST API token middleware does not protect this MCP listener.

Fixed in

1.120.0

Mitigation

Update github.com/f1bonacc1/process-compose to 1.120.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-5gm3-9crp-6g3v

github.com/obot-platform/obot

A logged-in Obot user following an attacker authorization URL can issue an OAuth token accepted beyond the requested MCP audience, without the intended consent boundary.

Fixed in

0.23.0

Mitigation

Update github.com/obot-platform/obot to 0.23.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-xwmw-prc4-v3cr

github.com/obot-platform/obot

Obot registry endpoints remain anonymously readable when OBOT_SERVER_ENABLE_REGISTRY_AUTH=true. The disclosed data is catalog metadata, not credential values or authenticated server access.

Fixed in

0.23.0

Mitigation

Update github.com/obot-platform/obot to 0.23.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-pr6h-vr44-xq8j

github.com/obot-platform/obot

Obot users with Power User or higher privileges can register a remote MCP URL that causes server requests to internal destinations, including through OAuth metadata discovery.

Fixed in

0.23.0

Mitigation

Update github.com/obot-platform/obot to 0.23.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-jgh3-fggc-mcpm

@roomi-fields/notebooklm-mcp

Vault batch output accepts paths outside the intended directory. Version 2.0.3 sanitizes slug_prefix, but vault containment requires NOTEBOOKLM_VAULT_ROOT; leaving it unset preserves unrestricted writes.

Fixed in

2.0.3

Mitigation

Update to 2.0.3 or later AND set NOTEBOOKLM_VAULT_ROOT to the intended vault root; restrict the process filesystem permissions.

Source: https://github.com/advisories/GHSA-jjhp-8crj-mppq

@aborruso/ckan-mcp-server

CKAN server URL validation checks hostname text without validating the resolved address. Unauthenticated self-hosted HTTP deployments can reach internal services; stdio requires control of tool arguments.

Fixed in

0.4.108

Mitigation

Update @aborruso/ckan-mcp-server to 0.4.108 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-798p-78g2-v556

mcp-atlassian

Shared-credential HTTP deployments combine missing caller authentication with unrestricted attachment reads, exposing host files through Atlassian uploads.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-cc5h-2pwp-pvcc

mcp-atlassian

HTTP callers can combine service headers pointing to a selected Atlassian endpoint with unrestricted attachment paths to exfiltrate server-readable files.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-wv8v-v4c5-v75j

mcp-atlassian

Jira project and Confluence space filters can be bypassed by query construction or missing checks on agile endpoints, within the credentials available to the server.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-w66g-j6c4-hcfc

mcp-atlassian

HTTP callers with upload access can submit server-local paths to attachment operations, including the Jira issue-update attachment flow.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-vc25-24vv-fxxm

mcp-atlassian

Jira update_issue accepts attachment paths without a workspace boundary, allowing the MCP process to disclose files using its own privileges.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-2xj6-xx86-cwwc

mcp-atlassian

ENABLED_TOOLS and TOOLSETS filter tool listings but not direct tool calls. READ_ONLY_MODE retains separate call-time enforcement.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-3r68-hf9h-887v

mcp-atlassian

In HTTP or multi-user deployments, write-capable callers can upload server-readable files to accessible Atlassian issues or pages. This primitive is file disclosure, not direct execution.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-mrq8-fv7v-hhjg

mcp-atlassian

The attachment read direction remains unrestricted after the earlier download write fix, including attachments passed through Jira update_issue.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-f4p7-qx46-wc5j

mcp-atlassian

Confluence upload tools lack path containment. The advisory distinguishes the similar Jira upload mixin from a directly registered MCP tool.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-h7wj-5v37-59r2

mcp-atlassian

Jira and Confluence upload implementations read caller-supplied paths without the containment checks used in the download direction.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-mfv2-4wvm-9pgp

mcp-atlassian

Header URL validation and connection establishment resolve DNS separately, leaving a rebinding window before the initial outbound request.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-49xv-9743-pw8w

mcp-atlassian

Attachment upload methods do not apply the path restrictions used by downloads; a permitted caller can disclose readable server files.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-f26r-j276-ggg4

mcp-atlassian

SSRF redirect validation is attached to the header-PAT client but omitted from basic-auth and OAuth clients.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-6529-c226-h328

mcp-atlassian

A caller with attachment write access to a Confluence page can exfiltrate server-readable files through the unvalidated upload path.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-6cr4-ccf3-x7h4

mcp-atlassian

OAuth token fallback files use default filesystem permissions rather than owner-only permissions, exposing credentials on shared hosts.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-4596-2p6p-28cv

mcp-atlassian

The Confluence upload path lacks the containment added to downloads, allowing tool callers to upload readable server files to a selected Confluence endpoint.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-p6hp-93wp-fh6p

mcp-atlassian

The OAuth setup callback reflects an unescaped error parameter into HTML while the setup server is running and reachable.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-g2r2-3j32-j27x

mcp-atlassian

Some header-derived Atlassian URLs reach API clients without the SSRF validation intended by an earlier fix.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-5wf4-jqxh-8gm3

mcp-atlassian

Download containment defaults to the process working directory. When that directory holds application modules, attachment downloads can overwrite executable code for a later restart.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-6vmq-24h2-pj7j

mcp-atlassian

Header-based Atlassian URLs can pass one URL parser while the downstream HTTP client resolves a different destination, bypassing SSRF restrictions.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-hgcf-4mq8-5266

mcp-atlassian

HTTP deployments using shared server credentials can accept unauthenticated callers or arbitrary non-empty tokens and act with the operator credentials.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-wrhw-j3f9-8vc6

mcp-atlassian

Write-capable attachment callers can make Jira or Confluence read server-local files and upload them using the configured Atlassian credentials.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-f6pj-qv47-g96w

mcp-atlassian

The Jira user-permission lookup bypasses the guarded HTTP session, allowing an attacker-controlled Atlassian endpoint to redirect requests to internal services.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-v9m3-wfh8-5646

mcp-atlassian

OAuth fallback token files inherit the process umask, exposing plaintext access and refresh tokens to other local users even when keyring storage succeeds.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-g5xv-mhgm-v5f6

mcp-atlassian

Confluence attachment upload omits path validation and can disclose files readable by the MCP process to a caller-controlled page.

Fixed in

0.22.0

Mitigation

Update mcp-atlassian to 0.22.0 or later and review the deployment conditions in the advisory.

Source: https://github.com/advisories/GHSA-93xw-j965-9mx3

Claude Code (September permission and plugin fixes)

September releases correct permission path checks, managed-policy failure handling, plugin path containment, archive permissions and secret exposure in diagnostic output.

Fixed in

2.1.269 includes the reviewed fixes

Mitigation

Update to 2.1.269 or later and review permission rules and installed plugin provenance.

Source: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

Visual Studio Code (Nested configuration Restricted Mode bypass)

Restricted workspace settings expressed as nested objects can take effect without workspace trust, allowing settings intended to remain blocked.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-q2f8-hh8x-wpc2

Visual Studio Code (Agent URL authority and domain policy bypass)

Agent web and browser tools can bypass denied destinations through inconsistent URL parsing or ignored valid administrator patterns when network filtering is enabled.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-hr37-8jwr-q8p8

Visual Studio Code (Webview resource root escape)

A webview using non-file resource schemes can exploit inconsistent separator handling to read content outside the extension's allowed resource roots.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-x5qc-gqm7-93qp

Visual Studio Code (Copilot Chat ADO token endpoint override)

Repository settings can redirect authenticated Azure DevOps Code Search requests to an attacker endpoint and expose the user's token.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-rvgr-2w56-2j67

Visual Studio Code (Chat remote media request before filtering)

Rendering agent-provided remote media can initiate a request before the chat policy removes the element, potentially leaking data encoded in its URL, including on history restoration.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-vww8-mqc2-4x8v

Visual Studio Code (MCP gallery metadata path traversal)

Installing or updating attacker-controlled MCP gallery metadata can write beyond per-server storage; uninstalling the entry can delete an unintended directory.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-g6p5-6xp8-5jwg

Visual Studio Code (Mapped IPv6 deny-only policy bypass)

With agent filtering enabled, an IPv4 deny entry and an empty allow list, an equivalent mapped IPv6 address can bypass the denied destination.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-4xcg-6mm5-hj26

Visual Studio Code (Browser URL separator network bypass)

With agent filtering and browser chat tools enabled, URL separator interpretation differs between policy validation and browser navigation, permitting requests to restricted hosts.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-4gv7-q2x8-32p8

Visual Studio Code (Workspace remote agent host permissions)

Workspace settings can choose a remote agent host and grant it local-file access, enabling data access or code execution when the crafted repository is opened.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-2cmq-rv52-5rf6

Visual Studio Code (Workspace Trust service bypass)

An untrusted workspace can connect to attacker-controlled services and bypass restrictions without the user granting workspace trust.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-r2gr-w3c8-wvqv

Goose CLI (goose review)

Review context collection invokes Git with repository-controlled fsmonitor configuration, allowing host command execution before the model or tool approval flow runs.

Fixed in

1.44.0

Mitigation

Upgrade to 1.44.0 or later; review the provenance of folders delivered with Git metadata.

Source: https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r

FrontMCP, @frontmcp/adapters and mcp-from-openapi

Loading an untrusted OpenAPI specification can reach private endpoints through external references that bypass the earlier SSRF fix. Deployment exposure depends on who can supply adapter specifications.

Fixed in

frontmcp/@frontmcp/adapters 1.5.0; mcp-from-openapi 2.5.0

Mitigation

Upgrade the affected packages; disable external references for untrusted specifications where possible.

Source: https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c

mysql-mcp-server (SSE transport)

SSE transport lacks Origin/Host validation and request authentication, permitting SQL execution with the configured database account. Default stdio transport is unaffected.

Fixed in

0.4.2

Mitigation

Upgrade to 0.4.2 or later; restrict network exposure and database privileges.

Source: https://github.com/designcomputer/mysql_mcp_server/security/advisories/GHSA-rqfv-2mw9-78g2

awslabs.dynamodb-mcp-server (CDK generator)

Crafted table, index or attribute names in an untrusted data model can inject code into generated CDK output, executed by the host deploying the application.

Fixed in

2.1.6

Mitigation

Upgrade to 2.1.6 or later and review untrusted data models before generating or deploying CDK output.

Source: https://aws.amazon.com/security/security-bulletins/2026-097-aws/

Filesystem MCP Server

Symlink escape to arbitrary filesystem access / potential LPE

Fixed in

0.6.3 / 2025.7.1

Mitigation

Update to >= 0.6.3; avoid Filesystem MCP in sensitive environments

Source: Cymulate EscapeRoute

Filesystem MCP Server

Naive prefix-match directory bypass (startsWith on paths)

Fixed in

0.6.3 / 2025.7.1

Mitigation

Update to >= 0.6.3

Source: Cymulate EscapeRoute

MCP Inspector

RCE via unauthenticated proxy on 0.0.0.0; drive-by RCE from malicious web page

Fixed in

0.14.1

Mitigation

Update to >= 0.14.1; restrict to localhost

Source: Recorded Future / SocRadar

MCP Git Server (mcp-server-git)

git_init path traversal — arbitrary filesystem path for repo creation

Fixed in

2025.9.25

Mitigation

Update; restrict Git MCP to trusted repos

Source: The Hacker News / PointGuard AI

MCP Git Server (mcp-server-git)

Argument injection in git_diff/git_checkout — shell metacharacters via user-controlled args

Fixed in

2025.12.18

Mitigation

Update; sanitize all user inputs to git CLI

Source: The Hacker News / PointGuard AI

MCP Git Server (mcp-server-git)

--repository path validation bypass — access beyond allowlist

Fixed in

2025.12.18

Mitigation

Update; enforce strict path validation

Source: The Hacker News / PointGuard AI

MCP Python SDK (mcp on PyPI)

DNS rebinding to local HTTP MCP servers when using FastMCP HTTP/SSE with no auth

Fixed in

1.23.0

Mitigation

Update to >= 1.23.0; enable TransportSecuritySettings explicitly

Source: Debian Security Tracker

MCP Python SDK (mcp on PyPI)

Missing Host/Origin validation on the deprecated WebSocket server transport (mcp.server.websocket.websocket_server); a hostile web page can drive a user's local MCP server via a cross-site WebSocket connection (DNS rebinding / cross-site WS hijack), bypassing authentication

Fixed in

1.28.1

Mitigation

Update to >= 1.28.1; stop using the deprecated websocket_server transport

Source: SentinelOne; Tenable; NVD (published 2026-07-15)

MCP Python SDK (mcp on PyPI)

SseServerTransport / StreamableHTTPSessionManager route messages by session_id query param or Mcp-Session-Id header alone, without verifying the authenticated principal owns that session; a second bearer-token-authenticated client that knows a session ID can inject JSON-RPC messages into it (session hijacking)

Fixed in

1.27.2

Mitigation

Update to >= 1.27.2

Source: NVD / OpenCVE

MCP Python SDK (mcp on PyPI)

Experimental task API (server.experimental.enable_tasks()) tracks tasks.list/get/result/cancel by task ID only, not by the session that created them; any connected client can enumerate or consume another client's tasks (cross-session data exposure)

Fixed in

1.27.2

Mitigation

Update to >= 1.27.2; disable experimental task handlers unless required

Source: NVD

MCP Gateway

DNS rebinding against SSE/streaming listeners — indirect access to MCP servers behind gateway

Fixed in

0.28.0

Mitigation

Update to > 0.27.0

Source: Blog Gowrishankar

MCP TypeScript SDK

Cross-client response data leak when reusing single server+transport across multiple SSE clients

Fixed in

1.26.0

Mitigation

Update to >= 1.26.0; isolate transport instances per client

Source: Feedly CVE

Cursor IDE

CurXecute — RCE via prompt injection writing .cursor/mcp.json

Fixed in

1.3.9

Mitigation

Update to Cursor >= 1.3.9; file integrity monitoring on mcp.json

Source: Checkpoint / PropelCode

Cursor IDE

MCPoison — persistent RCE via trusted config mutation; post-approval changes auto-execute

Fixed in

1.3.9

Mitigation

Update to >= 1.3.9; Git hooks + hash verification on mcp.json

Source: Checkpoint

Claude Code

8 command execution bypasses via blocklist flaws (man --html, sed e modifier, git arg ambiguity, bash variable expansion)

Fixed in

1.0.93

Mitigation

Update to Claude Code >= 1.0.93

Source: Flatt Security

Claude Code WebFetch

SSRF via startsWith() domain validation bypass in WebFetch (trusted-domain prefix attack)

Fixed in

1.0.111

Mitigation

Update to Claude Code >= 1.0.111

Source: SentinelOne

Claude Code

RCE via enableAllProjectMcpServers config — malicious .claude/settings.json or .mcp.json sets flag to auto-start MCP servers before trust dialog is shown; injected commands execute immediately upon claude startup in untrusted directory

Fixed in

1.0.111

Mitigation

Update to Claude Code >= 1.0.111; never run claude in untrusted repositories without reviewing config files first

Source: Check Point Research (2026-02-25)

Claude Code

API key exfiltration via ANTHROPIC_BASE_URL in malicious repository config — attacker sets ANTHROPIC_BASE_URL to attacker-controlled server in .claude/settings.json; Claude Code sends API requests (including bearer API key) before trust dialog is presented

Fixed in

2.0.65

Mitigation

Update to Claude Code >= 2.0.65; inspect .claude/settings.json and .mcp.json before opening unfamiliar repos

Source: Check Point Research (2026-02-25)

Claude Code

Sandbox bypass — commands excluded from sandboxing could bypass Bash permission enforcement (details undisclosed)

Fixed in

2.1.34

Mitigation

Update to Claude Code >= 2.1.34

Source: Claude Code CHANGELOG v2.1.34

Framelink Figma MCP Server (figma-developer-mcp)

Command injection via unsanitized input in fetchWithRetry curl command

Fixed in

0.6.3

Mitigation

Update to >= 0.6.3

Source: Geordie AI / EndorLabs

Microsoft Playwright MCP Server (@playwright/mcp)

DNS rebinding / Origin-less CSRF — missing Origin validation on local instance

Fixed in

0.0.40

Mitigation

Update to >= 0.0.40

Source: Mondoo / NVD

MCP SSE Transport (oatpp-mcp)

Prompt hijacking via predictable/reused session IDs; attacker replaces tool outputs

Fixed in

Unknown

Mitigation

Use cryptographically secure session IDs (128+ bits entropy)

Source: JFrog

Godot MCP Server (godot-mcp)

Command injection via user-controlled projectPath passed to exec()

Fixed in

0.1.1

Mitigation

Update to >= 0.1.1; sanitize projectPath; avoid exec() with user input

Source: Feedly CVE

mcp-package-docs

Command injection in child_process.exec via unsanitized input

Fixed in

0.1.28

Mitigation

Update to >= 0.1.28

Source: NVD

MCPJam Inspector

RCE via crafted HTTP request that triggers automatic MCP server installation; allows remote attacker to execute arbitrary code on developer machine

Fixed in

1.4.3

Mitigation

Update MCPJam Inspector to >= 1.4.3; restrict to localhost; do not expose MCPJam to untrusted networks

Source: Immersive Labs / CVE-2026-23744

xcode-mcp-server (r-huijts)

Command injection in registerXcodeTools function via unsanitized args argument passed to exec(); allows RCE or data exfiltration

Fixed in

after commit f3419f00117aa9949e326f78cc940166c88f18cb

Mitigation

Update to latest commit post-f3419f00; avoid passing user-controlled input to exec(); switch to execFile() with argument arrays

Source: SentinelOne

gemini-mcp-tool

Command injection via LLM-generated arguments passed directly to shell execution primitives without validation; network-reachable RCE via JSON-RPC CallTool requests requiring no authentication and no user interaction

Fixed in

no fix confirmed at time of research (2026-02-22)

Mitigation

Replace shell string execution with execFile() and argument arrays; validate all LLM-generated arguments before passing to any exec primitive; do not expose gemini-mcp-tool to untrusted networks

Source: Penligent AI

mcp-run-python

SSRF via overly permissive Deno sandbox configuration — sandbox allows localhost interface access, enabling attackers to reach internal network resources through crafted Python code execution requests

Fixed in

unknown — check upstream for patch

Mitigation

Restrict Deno sandbox network permissions to block localhost/internal ranges; do not expose mcp-run-python to untrusted inputs or external networks

Source: Snyk (2026-02-09)

MCP Salesforce Connector

Arbitrary attribute access — prior to 0.1.10, attacker can access arbitrary object attributes via crafted MCP requests, potentially exposing sensitive Salesforce data

Fixed in

0.1.10

Mitigation

Update MCP Salesforce Connector to >= 0.1.10; enforce attribute allowlists

Source: NVD

sf-mcp-server (Salesforce MCP)

Command injection via unsafe child_process.exec when constructing Salesforce CLI commands with user-controlled input; allows arbitrary code execution on the host

Fixed in

unknown — check upstream

Mitigation

Replace child_process.exec with execFile() and sanitize all user-controlled inputs; avoid sf-mcp-server until patched

Source: NVD (2026-02-11)

eBay API MCP Server (open-source)

Environment variable injection via updateEnvFile function in ebay_set_user_tokens tool — all versions vulnerable; attacker can inject arbitrary env variables to the .env file

Fixed in

no fix confirmed

Mitigation

Sanitize all inputs to updateEnvFile; do not expose eBay MCP Server to untrusted inputs

Source: CVEDetails (2026-02-20)

MCP Git Server (mcp-server-git)

Path traversal in git_add tool — unsafe GitPython repo.index.add() call without path boundary validation allows staging/committing files outside repo (e.g. /etc/shadow, ~/.ssh/id_rsa); attacker or confused LLM can exfiltrate sensitive host files via a commit push

Fixed in

2026.1.14

Mitigation

Update mcp-server-git to >= 2026.1.14; audit recent git commits managed by agents for unexpected file paths

Source: NVD / dev.to (2026-02-26)

OpenClaw (aka clawdbot, Moltbot)

Authentication token theft and RCE via malicious gatewayUrl — OpenClaw automatically establishes a WebSocket connection to a URL provided in the query string without origin validation; clicking attacker-crafted link causes OpenClaw to transmit auth token to attacker-controlled server; attacker replays token for full system access. 17,500+ internet-exposed instances identified.

Fixed in

2026.1.29

Mitigation

Update OpenClaw to >= 2026.1.29; block public internet exposure of OpenClaw instances

Source: SonicWall / Hunt.io / runZero (2026-02-03 to 2026-02-26)

Claude Code

Sandbox escape via persistent configuration injection — bubblewrap sandbox failed to protect missing .claude/settings.json; malicious code running inside sandbox creates settings.json with SessionStart hooks that execute with host privileges after Claude Code restart

Fixed in

2.1.2

Mitigation

Update Claude Code to >= 2.1.34 (covers this and subsequent fixes); monitor .claude/settings.json for unexpected SessionStart hooks

Source: NVD / GHSA-ff64-7w26-62rf (2026-02-06)

MCP Manager for Claude Desktop

Command injection sandbox escape — execute-command functionality fails to sanitize user-supplied strings from MCP config objects before passing to system calls; attacker crafts malicious webpage with injected config objects, causing MCP Manager to execute arbitrary commands outside the sandbox

Fixed in

unknown — check upstream

Mitigation

Restrict MCP Manager access to trusted configurations only; sanitize all MCP config object fields before system calls; block untrusted file/webpage access

Source: NVD / ZDI-CAN-27810 (2026-01-22)

HexStrike AI MCP Server (0x4m4)

Command injection via semicolon-prefixed argument — EnhancedCommandExecutor class fails to sanitize command-line arguments; attacker provides argument beginning with ; to API endpoint, executing arbitrary commands with MCP server privileges (typically root in default config)

Fixed in

no fix confirmed at time of research

Mitigation

Sanitize all command-line arguments; replace exec()-style calls with execFile() with argument arrays; do not expose HexStrike AI MCP Server to untrusted networks or inputs

Source: Check Point Advisories / NVD (2025-11-30)

nmap-mcp-server (PhialsBasement)

Command injection in Nmap CLI Command Handler — child_process.exec in src/index.ts processes special elements (CWE-74/CWE-77) without sanitization; remotely exploitable with no authentication required

Fixed in

patch commit 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488

Mitigation

Apply patch commit 30a6b9e...; replace child_process.exec with execFile() and argument arrays; sanitize all nmap arguments

Source: NVD / PT Security (2026-03-04)

Azure MCP Server Tools (Microsoft Azure)

SSRF leading to managed identity token theft and privilege escalation — attacker sends crafted input to exposed Azure MCP Server endpoint; server forwards request to attacker-controlled URL including its managed identity token; attacker captures token and gains all permissions associated with the MCP server's managed identity (can reach Azure resources, management APIs, subscriptions)

Fixed in

March 10, 2026 Patch Tuesday update

Mitigation

Apply Microsoft March 2026 security update; restrict Azure MCP Server endpoints to trusted callers; audit managed identity permissions (principle of least privilege); monitor for unexpected outbound requests from MCP server processes

Source: Microsoft Patch Tuesday March 2026 / Tenable / The Hacker News (2026-03-10)

quip-mcp-server (version 1.0.0)

Command injection in setupToolHandlers function — fails to sanitize user input before passing to system commands; allows remote attackers with low privileges to execute arbitrary commands on the underlying system

Fixed in

no fix available at time of disclosure — maintainers unresponsive

Mitigation

Avoid quip-mcp-server until patched; replace with sanitized alternatives; do not expose to untrusted networks

Source: SentinelOne (2026-03-19)

mcp-server-auto-commit (version 1.0.0)

Command injection in getGitChanges function in index.ts — unsanitized user input passed to shell commands; requires local access to exploit

Fixed in

commit f7d992c830c5f2ec5749852e66c0195e3ed7fe30

Mitigation

Apply patch commit f7d992c...; replace exec() with execFile() and argument arrays

Source: SentinelOne (2026-03-19)

MCP Go SDK (go-sdk) Streamable HTTP transport

CSRF vulnerability in Streamable HTTP transport — cross-site POST requests with text/plain content-type trigger arbitrary tool execution on local MCP servers without user interaction

Fixed in

check upstream for patch

Mitigation

Restrict MCP Go SDK HTTP servers to localhost with proper Origin validation; prefer stdio transport for local deployments; update to latest version

Source: Miggo.io (2026-03-22)

AWS API MCP Server (versions 0.2.14 through 1.3.9)

Improper Protection of Alternate Path — attacker bypasses file access restrictions in no-access and workdir features, potentially exposing configuration files and credentials on local filesystem; requires local access, no authentication needed

Fixed in

1.4.0 or later

Mitigation

Update AWS API MCP Server to >= 1.4.0; restrict MCP server to trusted local users only; audit file access permissions post-update

Source: SentinelOne (2026-03-19)

MCP Atlassian (mcp-atlassian, Confluence and Jira)

Unauthenticated SSRF via header injection — prior to version 0.17.0, attacker can forge server-side requests to internal Atlassian or adjacent network resources without authentication

Fixed in

0.17.0

Mitigation

Update mcp-atlassian to >= 0.17.0; restrict MCP Atlassian to trusted networks; audit outbound requests from Atlassian MCP server

Source: Miggo.io (2026-03-11); Rogue Security MCPwnfluence chain analysis (2026-03-23)

MCP Atlassian (mcp-atlassian)

Unrestricted file write in mcp-atlassian — chains with CVE-2026-27826 (SSRF) for full unauthenticated RCE as root via MCPwnfluence attack chain; requires only two HTTP requests from local network; no authentication needed

Fixed in

0.17.0

Mitigation

Update mcp-atlassian to >= 0.17.0; do not expose MCP Atlassian on public or untrusted networks; monitor for unexpected file writes

Source: Pluto Security / Rogue Security MCPwnfluence (2026-03-23)

Srmorete adb-mcp (ADB MCP Server, Node.js)

Command injection in ADB MCP Server versions 0.1.0 and prior — user-controlled input in tool definitions passed to system commands via string concatenation without sanitization; shell metacharacters (;, |, &&, $(), backticks) enable arbitrary command execution with MCP server process privileges; network-accessible, no authentication required, low complexity

Fixed in

commit 041729c or later

Mitigation

Update adb-mcp to patched version (commit 041729c+); restrict network access to trusted sources only; implement WAF with command injection rules; audit logs for exploitation attempts

Source: NVD (2025-09-25); SentinelOne (2026-03-24)

mcp-memory-service (multi-agent memory backend, Python)

Critical CORS misconfiguration in mcp-memory-service prior to 10.25.1 — when HTTP server enabled (MCP_HTTP_ENABLED=true), overly permissive CORS settings (allow_origins=['*'], allow_credentials=True) allow any website to read API responses cross-origin, enabling cross-origin memory theft and unauthorized access to agent memory stores

Fixed in

10.25.1

Mitigation

Upgrade mcp-memory-service to >= 10.25.1; set MCP_HTTP_ENABLED=false if HTTP not required; restrict CORS origins to trusted domains; never expose memory service endpoints to public networks

Source: SentinelOne / integsec.com (2026-03-27)

MCP Ruby SDK (mcp gem, streamable_http_transport.rb)

Session hijacking vulnerability in MCP Ruby SDK prior to 0.9.2 — streamable_http_transport.rb lacks sufficient session binding; attackers obtaining a valid session ID can intercept all real-time data from Server-Sent Events (SSE) streams, exfiltrating tool responses and agent outputs

Fixed in

0.9.2

Mitigation

Update MCP Ruby SDK (mcp gem) to >= 0.9.2; bind SSE sessions to client IP and additional entropy; use short-lived session tokens; prefer stdio transport over HTTP when possible

Source: Tenable CVE / GitLab Security Advisories (2026-03-27)

agentfront enclave (JavaScript sandbox for AI agent code execution)

Sandbox escape in agentfront enclave prior to version 2.11.1 — improper control of code generation allows escape from the secure JavaScript sandbox designed for safe AI agent code execution; enables arbitrary code execution outside the sandboxed environment

Fixed in

2.11.1

Mitigation

Update agentfront enclave to >= 2.11.1; apply defense-in-depth by adding OS-level sandboxing (Docker, gVisor) around the sandbox process; do not rely solely on JS sandbox for isolation of untrusted code

Source: radar.offseq.com (2026-03-28)

Bun runtime (bun.sh)

Malicious npm packages can execute lifecycle scripts (postinstall) without validating source origin — allows supply chain payloads to run during npm install in Bun environments; affects developer machines using Bun as runtime

Fixed in

v1.3.5

Mitigation

Update Bun to >= 1.3.5; audit package postinstall hooks before running install; prefer lockfile-verified installs

Source: Security research (2026-03); referenced in Claude Code supply chain risk analysis

Framelink Figma MCP Server (figma-developer-mcp)

Command injection RCE via fetchWithRetry method — user-supplied input passed to system calls without sanitization of shell metacharacters; authentication not required; allows arbitrary code execution with MCP server service account privileges

Fixed in

latest patched version (see upstream)

Mitigation

Update Framelink Figma MCP Server to latest version; sanitize all user-supplied inputs; restrict MCP Server network access to trusted sources

Source: ZDI-25-1197 / SentinelOne (2025-12-29, NVD published 2026-01-23)

aws-mcp-server

Command injection via improper validation of the allowed commands list — remote attackers can execute arbitrary code without authentication by passing shell metacharacters in command arguments; vendor rejected initial report, published as 0-day advisory by ZDI

Fixed in

no vendor patch — treat as unpatched 0-day; avoid using aws-mcp-server in network-accessible environments

Mitigation

Do not expose aws-mcp-server to untrusted network access; use allowlists enforced at OS level; consider alternative AWS MCP implementations with active security support; monitor ZDI advisory for future vendor patch

Source: ZDI-26-246 (2026-03-30); vendor rejected initial report

LibreChat (versions 0.8.2-rc1 through 0.8.3-rc1)

Information disclosure via malicious MCP server — insufficient access control in MCP server header processing allows credential placeholders to resolve to victim user OAuth tokens rather than the server creator's credentials; malicious MCP server can exfiltrate OAuth tokens through HTTP headers

Fixed in

0.8.3-rc2 or later — check upstream

Mitigation

Update LibreChat to >= 0.8.3-rc2; do not add MCP servers from untrusted sources in LibreChat; audit all configured MCP servers for unexpected HTTP header handling

Source: SentinelOne (2026-04-03)

Go MCP SDK (HTTP-based MCP servers using StreamableHTTPHandler or SSEHandler)

DNS rebinding vulnerability in Go MCP SDK prior to 1.4.0 — HTTP-based MCP servers on localhost without authentication lack DNS rebinding protection; malicious websites can bypass same-origin policy via DNS rebinding attack to invoke MCP tools or access resources on the local MCP server using developer credentials

Fixed in

1.4.0

Mitigation

Update Go MCP SDK to >= 1.4.0; prefer stdio transport over HTTP for local MCP servers; implement Host header validation; add authentication to all HTTP-based MCP server endpoints; do not run HTTP MCP servers on localhost without auth

Source: NVD / Red Hat (2026-04-02)

a11y-mcp (accessibility MCP server, priyankark, up to 1.0.5)

Server-side request forgery in a11y-mcp versions up to 1.0.5 via A11yServer function in src/index.js — requires local initiation but allows requests to internal network resources through the accessibility scanning functionality

Fixed in

1.0.6

Mitigation

Update a11y-mcp to >= 1.0.6; restrict a11y-mcp network access to trusted targets; validate all URLs passed to A11yServer function

Source: Tenable / NVD (2026-04-02)

Apollo MCP Server (prior to version 1.7.0)

Missing Host header validation on incoming HTTP requests when using StreamableHTTP transport — allows DNS rebinding attacks that bypass same-origin policy and invoke tools or access resources on behalf of local users; risk is mitigated in deployments using authentication, network controls, or stdio transport

Fixed in

1.7.0

Mitigation

Update Apollo MCP Server to >= 1.7.0; prefer stdio transport over HTTP; implement Host header validation; add authentication to all HTTP-based MCP server endpoints; do not run HTTP MCP servers on localhost without auth

Source: NVD (2026-04-10)

runZero Platform (prior to version 4.0.260202.0)

Information disclosure (CWE-863: Incorrect Authorization) — MCP agents could access remediation and asset information from outside the authorized organization scope; cross-org data leakage through misconfigured MCP authorization boundaries

Fixed in

4.0.260202.0

Mitigation

Update runZero Platform to >= 4.0.260202.0; audit MCP agent permissions to ensure org-scope isolation; validate organization boundary enforcement after upgrade

Source: runZero advisory (2026-04-07)

mcp-server-taskwarrior (awwaiid, up to 1.0.1)

Command injection through the Identifier argument in server.setRequestHandler — requires local attack initiation but allows arbitrary command execution via unvalidated task identifier input passed to the shell

Fixed in

patched; update to latest version

Mitigation

Update mcp-server-taskwarrior to latest patched version; restrict server to trusted local environments; sanitize all task identifier inputs

Source: NVD (2026-04-09)

mcp-summarization-functions (Braffolk, up to 0.1.5)

Vulnerability in Braffolk mcp-summarization-functions up to version 0.1.5 — exact nature of the flaw is not yet fully documented; treat as unverified pending full disclosure

Fixed in

0.1.6 or later — update to latest version

Mitigation

Update mcp-summarization-functions to latest version; do not use in production until full advisory is published

Source: CVEDetails (2026-04-06)

n8n-MCP (MCP server for n8n workflow documentation)

Vulnerability in n8n-MCP, a Model Context Protocol server providing AI assistants with comprehensive access to n8n node documentation and operations — exact nature not yet fully disclosed; CVE record reserved

Fixed in

update to latest version

Mitigation

Update n8n-MCP to latest version; monitor CVE record for full advisory; restrict n8n-MCP to trusted environments

Source: CVE.org (2026-04-09)

FastMCP and FastMCP OAuthProxy

The OAuthProxy component used for GitHub OAuth authentication does not properly validate a user's consent after authentication — an attacker could leverage this flaw to bypass OAuth consent validation and gain unauthorized access to connected MCP tools using a victim's GitHub identity

Fixed in

update to patched version — check upstream FastMCP releases

Mitigation

Update FastMCP to latest patched version; audit OAuth flows in any MCP server using FastMCP OAuthProxy; implement additional server-side consent validation; monitor GitHub OAuth grant tokens for unexpected usage

Source: Red Hat Security Advisory (2026-04-06)

nginx-ui (MCP integration, /mcp_message endpoint)

Missing authentication middleware on the /mcp_message endpoint in nginx-ui's MCP integration — the /mcp_message handler lacks the AuthRequired() middleware present on the /mcp endpoint, allowing unauthenticated network-adjacent attackers to invoke all 12 MCP tools (including nginx_config_add with auto-reload) and achieve complete nginx server takeover in two HTTP requests. 2,689 publicly reachable instances confirmed exposed. Actively exploited in the wild since March 2026; added to VulnCheck KEV April 13, 2026.

Fixed in

v2.3.4 (released 2026-03-15)

Mitigation

Update nginx-ui to >= v2.3.4 immediately; restrict /mcp_message to localhost or trusted network; do not expose nginx-ui admin interfaces to untrusted networks; audit nginx configs for unauthorized modifications

Source: Pluto Security / Rapid7 / Picus Security (2026-04-15 to 2026-04-16)

nginx-ui (/api/backup endpoint)

Unauthenticated /api/backup endpoint in nginx-ui leaks encryption keys used to decrypt database backups, exposing user credentials, SSL private keys, and node_secret values stored in the nginx-ui configuration

Fixed in

v2.3.4

Mitigation

Update nginx-ui to >= v2.3.4; restrict admin interface to trusted networks; rotate all credentials stored in nginx-ui after any exposure

Source: Picus Security (2026-04-16)

MariaDB MCP server (SSE service)

Information disclosure vulnerability in MariaDB MCP server — the SSE (Server-Sent Events) service lacks proper user validation, allowing unauthenticated attackers to access sensitive MCP data including database connection information and query results streamed via the SSE endpoint

Fixed in

update to latest version — check upstream MariaDB MCP releases

Mitigation

Update MariaDB MCP to latest version; enforce authentication on all SSE endpoints; do not expose MariaDB MCP server to untrusted networks

Source: SentinelOne (2026-04-15)

Windsurf AI IDE (MCP integration)

Zero-click prompt injection in Windsurf's MCP integration — attacker crafts malicious prompts that developers copy and paste, causing the MCP agent to write malicious configuration entries and execute arbitrary commands without any user interaction; part of the broader OX Security STDIO design flaw research affecting 150M+ MCP SDK downloads

Fixed in

check upstream Windsurf releases

Mitigation

Update Windsurf to latest patched version; treat all copied prompts from untrusted sources as potentially adversarial; audit MCP server configurations after opening external repositories; sandbox MCP service execution

Source: OX Security (2026-04-15)

MCP STDIO interface (all SDK languages: Python, TypeScript, Java, Rust)

Architectural design flaw in Anthropic's Model Context Protocol STDIO interface — the SDK receives a configuration to start a tool, uses STDIO to run it, and performs no validation of input before executing commands on the operating system. Affects all major MCP SDKs and an estimated 200,000+ servers and 150M+ downloads. Anthropic has stated this is 'by design' and that input sanitization is the developer's responsibility. Enables arbitrary command execution in any application that integrates MCP without its own validation layer.

Fixed in

no vendor patch — Anthropic considers behavior by design

Mitigation

Validate and sanitize ALL user input before passing to MCP STDIO; run MCP services in sandboxes with restricted OS permissions; block public IP access to MCP services; treat all MCP configurations as untrusted; use only official MCP server directories; apply defense-in-depth with OS-level sandboxing

Source: OX Security (2026-04-15); The Register (2026-04-16)

LiteLLM (MCP SDK stdio transport)

Command injection via MCP SDK stdio transport in LiteLLM — StdioServerParameters executes the configured command even when it fails to produce a valid server handle, allowing arbitrary OS command execution when an attacker controls the command string via prompt injection or poisoned MCP marketplace configuration

Fixed in

patched — update LiteLLM to latest version

Mitigation

Update LiteLLM immediately; validate all MCP stdio command parameters; never derive MCP command strings from user-controlled input

Source: OX Security / LiteLLM (2026-04-15); CyberSecurityNews (2026-04-21)

Flowise (MCP STDIO integration)

Command injection via MCP STDIO interface in Flowise — attacker-controlled MCP configuration allows arbitrary OS command execution through the stdio transport layer without user interaction; discovered as part of OX Security's MCP STDIO architectural research

Fixed in

check upstream Flowise releases for patch

Mitigation

Update Flowise to latest version; sandbox MCP service execution; block public IP access to Flowise MCP endpoints; treat all MCP STDIO configurations as untrusted

Source: OX Security (2026-04-15); THN (2026-04-20)

Bisheng (MCP STDIO integration)

Command injection via MCP STDIO interface in Bisheng — arbitrary OS command execution through the stdio transport layer; discovered and patched as part of OX Security's MCP STDIO architectural research affecting the broader ecosystem

Fixed in

patched — update Bisheng to latest version

Mitigation

Update Bisheng immediately; validate all MCP command parameters at the application layer

Source: OX Security (2026-04-15); CyberSecurityNews (2026-04-21)

Serverless Framework (experimental MCP server feature)

Command injection RCE vulnerability in Serverless Framework's experimental MCP server feature — allows attackers to execute arbitrary system commands via maliciously crafted MCP requests to the Serverless CLI's MCP endpoint

Fixed in

check upstream Serverless Framework releases

Mitigation

Disable Serverless Framework experimental MCP server feature if not required; update to latest Serverless Framework version; do not expose the MCP endpoint to untrusted networks

Source: SentinelOne (2026-04-22)

Red Hat Ansible Automation Platform (AAP) MCP server

Unauthenticated remote log injection in the Red Hat AAP MCP server — an unauthenticated attacker can exploit a log injection vulnerability by sending specially crafted input to manipulate log entries, potentially poisoning audit trails or triggering downstream log processing vulnerabilities

Fixed in

check Red Hat AAP MCP server security errata

Mitigation

Apply Red Hat security errata for AAP MCP server; sanitize all MCP server log inputs; restrict MCP endpoint access to trusted networks only

Source: Red Hat Customer Portal (2026-04-17)

Claude Code CLI and Claude Agent SDK

OS command injection vulnerability in Claude Code CLI and Agent SDK — attackers craft malicious file paths containing shell metacharacters (e.g., $() or backticks) that are passed to system calls without sanitization, allowing arbitrary command execution with the privileges of the running agent

Fixed in

update Claude Code to latest version; see minimum_safe_versions

Mitigation

Update Claude Code to latest version; never process untrusted file paths without sanitization; restrict shell metacharacter input in file path arguments; run Claude Code with minimum required OS permissions

Source: SentinelOne (2026-04-10)

Anthropic Claude Code

Sandbox escape via symlink manipulation in Anthropic Claude Code — prior to version 2.1.64, Claude Code's sandbox implementation failed to prevent sandboxed processes from creating symbolic links pointing to locations outside the workspace directory; attackers can create crafted symlinks inside the sandbox that allow read or write access to arbitrary host filesystem paths. Part of a pair of RCE code paths documented by Sonar researchers (April 30, 2026); the second code path exploits how Claude Code reads and processes project configuration files on startup in untrusted directories.

Fixed in

2.1.64

Mitigation

Update Claude Code to >= 2.1.64 (or latest; see minimum_safe_versions); never run Claude Code in untrusted directories without reviewing project files first (CLAUDE.md, .mcp.json, .claude/settings.json); use --no-memory flag in untrusted contexts; treat project config files as executable code

Source: SentinelOne (2026-04-23); Sonar blog (2026-04-30)

Upsonic 0.71.6 (MCP server/task creation)

Remote code execution in Upsonic 0.71.6 — the application allows users to define MCP server configurations including command and arguments that are executed server-side without adequate validation; attackers with access to MCP configuration endpoints can achieve arbitrary command execution with service account privileges

Fixed in

update Upsonic to version after 0.71.6 — check upstream releases

Mitigation

Update Upsonic to latest version; restrict access to MCP server configuration interfaces; validate and sanitize all command parameters before execution; do not expose Upsonic configuration API to untrusted networks

Source: Red Hat Customer Portal (2026-04-16)

Sunwood-ai-labs command-executor-mcp-server (up to 0.1.0)

OS command injection in Sunwood-ai-labs command-executor-mcp-server up to version 0.1.0 — the execute_command function is vulnerable to command injection via unsanitized user-supplied input; a public exploit is available; vendor has not responded to disclosure

Fixed in

no vendor patch — treat as unpatched; avoid using this MCP server in any environment

Mitigation

Remove command-executor-mcp-server from all MCP configurations; do not run MCP servers with broad shell command execution capabilities without proper sandboxing and input validation; use alternative MCP servers with active security maintenance

Source: NVD / Tenable (2026-05-01)

TimBroddin astro-mcp-server (up to 1.1.1)

Security vulnerability in TimBroddin astro-mcp-server up to version 1.1.1 — the impacted function is in src/index.ts; exact nature not yet fully documented at time of writing

Fixed in

1.1.2 or later — update to latest version

Mitigation

Update astro-mcp-server to >= 1.1.2; monitor NVD entry for full advisory

Source: NVD (2026-05-01)

aws-mcp-server

Second command injection vulnerability in aws-mcp-server (ZDI-CAN-27969) — distinct from CVE-2026-5058 (ZDI-CAN-27968); both rated CVSS 9.8 unauthenticated RCE; vendor rejected reports for both CVEs and no patch is available for either

Fixed in

no vendor patch — both CVE-2026-5058 and CVE-2026-5059 are unpatched 0-days

Mitigation

Do not use aws-mcp-server in any network-accessible environment; use alternative AWS MCP implementations with active security support; apply OS-level command allowlists; monitor ZDI for future vendor engagement

Source: ZDI-26-246 (2026-03-30)

Apache Doris MCP Server (before 0.6.1)

Improper neutralization flaw in Apache Doris MCP Server query context handling — versions before 0.6.1 may allow execution of unintended SQL statements and bypass of access restrictions when attacker-controlled input is passed into query context; enables unauthorized data access and potential exfiltration via the MCP server's database interface

Fixed in

0.6.1 — update Apache Doris MCP Server immediately

Mitigation

Update to Apache Doris MCP Server >= 0.6.1; restrict MCP server access to trusted agent identities only; validate and parameterize all SQL query inputs; apply least-privilege database permissions to the MCP server service account

Source: NVD (2026-04-20)

Git MCP Server

Command injection vulnerability in Git MCP Server — attacker-controlled input passed to git operations without proper sanitization allows execution of arbitrary OS commands; enables full host compromise through the MCP interface

Fixed in

update to latest version — check upstream

Mitigation

Update Git MCP Server to latest patched version; restrict the MCP server to trusted localhost connections only; apply OS-level command sandboxing; use mcp-server-git 2026.1.14+ which addresses related path traversal (CVE-2026-27735)

Source: SentinelOne (2026-04-29)

LibreChat (STDIO MCP interface)

Command injection vulnerability in LibreChat's STDIO MCP interface — part of the systemic OX Security STDIO design flaw (ADVISORY-MCP-STDIO-2026-001); attacker-controlled external MCP server configuration can inject shell commands that execute with the privileges of the LibreChat process; separate from CVE-2026-31951 (LibreChat OAuth token exfiltration)

Fixed in

apply LibreChat patch for STDIO command injection — check upstream for patched release

Mitigation

Update LibreChat to patched version; validate and sanitize all External MCP Server command+args before passing to shell; do not allow untrusted users to configure MCP server commands; apply allowlisting for permitted MCP server executables

Source: OX Security MCP STDIO Advisory ADVISORY-MCP-STDIO-2026-001 (2026-04-15)

WeKnora (STDIO MCP interface)

Command injection vulnerability in WeKnora's STDIO MCP interface — part of the systemic OX Security STDIO design flaw (ADVISORY-MCP-STDIO-2026-001); attacker-controlled MCP server configuration injects OS commands executed with WeKnora process privileges

Fixed in

apply WeKnora patch — check upstream

Mitigation

Update WeKnora to patched version; restrict external MCP server configuration to trusted administrators; apply input validation on all MCP server command parameters

Source: OX Security MCP STDIO Advisory ADVISORY-MCP-STDIO-2026-001 (2026-04-15)

@akoskm/create-mcp-server-stdio (npm scaffold)

Command injection vulnerability in the @akoskm/create-mcp-server-stdio npm scaffold — part of the systemic OX Security STDIO design flaw; the scaffold generates MCP server boilerplate code that passes user-supplied arguments directly to shell without sanitization, propagating the vulnerability to all projects created with the template

Fixed in

use patched scaffold version — regenerate or patch existing servers created with vulnerable template

Mitigation

Stop using @akoskm/create-mcp-server-stdio until patched; audit all MCP servers created with this scaffold for command injection patterns; apply CWE-78 mitigations (input validation, command allowlisting) to generated server code

Source: OX Security MCP STDIO Advisory ADVISORY-MCP-STDIO-2026-001 (2026-04-15)

Microsoft AI Agent Frameworks (in-memory vector store + ExecuteCode/DownloadFileAsync tools)

Remote code execution vulnerability in Microsoft AI agent frameworks that expose both ExecuteCode and DownloadFileAsync tools — attacker chains these two tools to (1) create a malicious script in the agent sandbox, then (2) escape by downloading it to a dangerous host location (e.g. Windows Startup folder) for persistent execution; sandbox escape is achievable via legitimate tool-call chaining without any binary exploit

Fixed in

apply Microsoft patch; remove DownloadFileAsync or restrict its permitted download paths; update AI agent framework to latest version

Mitigation

Patch Microsoft AI agent framework to latest version; restrict DownloadFileAsync to safe target directories only; audit agent tool combinations for dangerous chaining potential (ExecuteCode + any write-to-startup-path tool); apply principle of least privilege on agent tool access; require human approval for file write + execute sequences

Source: Microsoft Security Blog (2026-05-07)

RMCP (Rust SDK for Model Context Protocol)

DNS rebinding vulnerability in RMCP's Streamable HTTP server transport — the server did not validate the incoming Host header, allowing a malicious public website via DNS rebinding to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. Attacker can make any tool call as if they were a locally-running MCP-connected AI agent.

Fixed in

1.4.0

Mitigation

Update rmcp crate to >= 1.4.0; validate Host header on all incoming Streamable HTTP server requests; bind MCP servers to 127.0.0.1 only when network access is not required

Source: Tenable / NVD (2026-05-14)

MCP Java SDK (official Java SDK for Model Context Protocol)

DNS rebinding vulnerability in the MCP Java SDK — allows an attacker to access a locally or network-private Java SDK MCP server via the victim's browser. The attack enables an attacker to make any tool call to the server as if they were a locally-running MCP-connected AI agent.

Fixed in

1.0.0

Mitigation

Update MCP Java SDK to >= 1.0.0 (GHSA-8jxr-pr72-r468); bind MCP servers to localhost only; validate Host header on all incoming requests

Source: Tenable (2026-04-07)

mcp-framework (npm)

Denial-of-service vulnerability in mcp-framework HTTP transport — the readRequestBody() function concatenates incoming POST body chunks without enforcing the configured maxMessageSize limit, allowing a remote unauthenticated attacker to crash any mcp-framework HTTP server by sending a single oversized request to the /mcp endpoint, exhausting server memory.

Fixed in

0.2.22

Mitigation

Update mcp-framework to >= 0.2.22; as interim measure, deploy reverse proxy (nginx/HAProxy) with request body size limits; restrict /mcp endpoint to trusted network sources; monitor for oversized POST requests

Source: SentinelOne (2026-04-16)

Claude Code

File-write sandbox bypass in Claude Code — piped sed and echo commands escaped the project sandbox because command chaining was not validated against the file-write restriction rules. Attackers could use piped commands to write arbitrary files outside the permitted project boundary.

Fixed in

2.0.55

Mitigation

Update Claude Code to >= 2.0.55; in multi-agent environments validate command chaining patterns; treat piped shell commands as potentially sandbox-escaping

Source: VentureBeat / BeyondTrust security research (2026-04-30)

Claude Code

Permission mode bypass in Claude Code — Claude Code resolved permission modes from .claude/settings.json before showing the workspace trust dialog. A malicious repository could set permissions.defaultMode to 'bypassPermissions', causing the trust dialog to never appear and auto-approving all tool calls from the malicious repository.

Fixed in

2.1.53

Mitigation

Update Claude Code to >= 2.1.53; always review .claude/settings.json for suspicious permission overrides before accepting workspace trust; never run claude in untrusted repositories

Source: VentureBeat / Adversa research (2026-04-30)

Claude Code

Deny-rule enforcement bypass via subcommand chain length — Claude Code silently dropped its configured deny rules once a command exceeded 50 subcommands. Attackers could craft commands with 50+ chained subcommands to bypass any configured allow/deny rules, including security-critical restrictions.

Fixed in

2.1.90

Mitigation

Update Claude Code to >= 2.1.90; audit any workflows with unusually long command chains; do not rely solely on deny-list rules without defense-in-depth controls

Source: Adversa AI / VentureBeat (2026-05-01)

Splunk MCP Server app (below 1.0.3)

Session and authorization tokens written to log files in clear text in Splunk MCP Server app versions below 1.0.3 — a user with access to the Splunk _internal index or the mcp_tool_admin capability can read authentication tokens in plain text, enabling session hijacking, privilege escalation, or unauthorized access to protected Splunk resources

Fixed in

1.0.3

Mitigation

Update Splunk MCP Server app to >= 1.0.3; restrict _internal index access to administrator roles only; rotate any tokens that may have been exposed; audit mcp_tool_admin capability assignments

Source: Splunk Advisory SVD-2026-0407 / SentinelOne / NVD (2026-04-15)

MS-Agent v1.5.2 (ModelScope, Alibaba)

Shell command injection in the MS-Agent Shell tool — six validation layers exist but all are bypassable via regex blacklist evasion; attacker injects crafted content into any data source consumed by the agent (prompts, documents, logs, research inputs) to execute arbitrary OS commands; no direct shell access or operator misuse required. Enables reading secrets (API keys, tokens, config files), dropping payloads, modifying workspace state, establishing persistence, and pivoting to adjacent services.

Fixed in

check upstream MS-Agent releases post-1.5.2

Mitigation

Update MS-Agent beyond v1.5.2; replace regex-based command blacklisting with a strict allowlist of permitted operations; never pass untrusted external content (documents, web pages, user input) directly to agent shell tools without sanitization; isolate MS-Agent execution in sandboxes

Source: SecurityWeek / Itamar Yochpaz (Medium) / CyberSecurityNews (2026-02)

Azure MCP Server (@azure-devops/mcp npm — Microsoft Azure DevOps integration)

Information disclosure via missing authentication in the Azure MCP Server — the server exposes tools for interacting with Azure DevOps (work items, repos, pipelines, pull requests) without proper authentication, allowing unauthenticated network-accessible attackers to read sensitive data including configuration details, API keys, authentication tokens, and project data. CVSS vector: AV:N/AC:L/PR:N/UI:N (network-reachable, no credentials required, no user interaction needed). The MCP SDK itself does not include built-in authentication — the implementation flaw places responsibility on each server.

Fixed in

no patch confirmed at time of research — Microsoft has published mitigation guidance; monitor Microsoft Security Response Center for updates

Mitigation

Do not expose Azure DevOps MCP server to untrusted networks; require authentication at the network perimeter (reverse proxy with auth); restrict access to trusted agent identities only; audit all Azure DevOps data accessible via the MCP server; monitor Microsoft MSRC for patch release

Source: Microsoft disclosure / WindowsNews.ai / Dev Community (2026-04-03)

OpenClaw (OpenShell managed sandbox backend)

TOCTOU race condition in the OpenShell managed sandbox backend — attacker redirects writes outside the intended sandbox boundary; can be used to modify configuration files, plant backdoors, and establish persistence on the host system. Most severe link in the Claw Chain exploit chain.

Fixed in

OpenClaw 2026.4.22

Mitigation

Update OpenClaw to >= 2026.4.22 immediately; apply OS-level file integrity monitoring on OpenClaw configuration directories; restrict OpenClaw sandbox backend write permissions at the OS level as defense-in-depth

Source: Cyera Research / The Hacker News (2026-05)

OpenClaw (OpenShell managed sandbox backend)

TOCTOU race condition enabling file reads outside the sandbox intended boundaries — attacker can exfiltrate sensitive system files, credentials, and internal artifacts by exploiting the race window during sandbox file access validation; first step in the Claw Chain attack: attacker uses this to expose credentials before chaining to CVE-2026-44118 for privilege escalation

Fixed in

OpenClaw 2026.4.22

Mitigation

Update OpenClaw to >= 2026.4.22; see CVE-2026-44112 for chain context

Source: Cyera Research / The Hacker News (2026-05)

OpenClaw (shell allowlist validation)

Incomplete list of disallowed inputs in the OpenClaw shell allowlist validation logic — attacker bypasses the allowlist to execute commands or access files that should be blocked; used as a stepping stone in the Claw Chain to expand the initial sandbox compromise

Fixed in

OpenClaw 2026.4.22

Mitigation

Update OpenClaw to >= 2026.4.22; see CVE-2026-44112 for chain context

Source: Cyera Research / The Hacker News (2026-05)

OpenClaw (privilege model)

Privilege escalation to owner-level control in OpenClaw — exploited in step 3 of the Claw Chain (after credential exposure via CVE-2026-44113 + CVE-2026-44115), allowing an attacker with initial plugin/prompt access to obtain full owner-level permissions on the OpenClaw instance; enables unrestricted configuration modification and backdoor installation in the final step (CVE-2026-44112)

Fixed in

OpenClaw 2026.4.22

Mitigation

Update OpenClaw to >= 2026.4.22; apply principle of least privilege on OpenClaw instances; do not expose OpenClaw admin interfaces to untrusted networks

Source: Cyera Research / Rescana / The Hacker News (2026-05)

Claude Code CLI and Claude Agent SDK

OS command injection via TERMINAL environment variable manipulation — Claude Code constructs a shell command using the TERMINAL variable with shell=true without sanitizing shell metacharacters; a local attacker or prompt-injection payload that controls the TERMINAL environment variable can execute arbitrary commands with Claude Code process privileges; first link in a 3-CVE chain: CVE-2026-35020 (TERMINAL injection) → CVE-2026-35021 (path injection) → CVE-2026-35022 (auth helper exfil)

Fixed in

Claude Code 2.1.92 / Claude Agent SDK 0.1.56

Mitigation

Update Claude Code to >= 2.1.92; do not allow untrusted environments to set the TERMINAL variable; run Claude Code in isolated environments with controlled env vars

Source: SentinelOne (2026-04-10); Phoenix Security (2026-04-03)

Claude Code CLI and Claude Agent SDK

OS command injection in authentication helper execution — helper config values (apiKeyHelper, awsAuthRefresh, awsCredentialExport, gcpAuthRefresh) are passed to shell with shell=true without input validation; attackers who influence these settings (e.g. via CVE-2026-35020 writing malicious .claude/settings.json) can inject shell metacharacters to execute arbitrary commands and exfiltrate credentials; confirmed via four escalating PoC variants including multi-line file exfiltration of Claude Code's own MEMORY.md conversation history over HTTP

Fixed in

Claude Code 2.1.92 / Claude Agent SDK 0.1.56

Mitigation

Update Claude Code to >= 2.1.92; sanitize all auth helper config values before shell execution; never allow untrusted content to set auth helper parameters; rotate any credentials that may have been exposed

Source: SentinelOne (2026-04-10); GitHub Advisory GHSA-479q-mw77-pmr5; Phoenix Security (2026-04-03)

claude-code-action (Anthropic GitHub Action for CI/CD)

Indirect prompt injection via GitHub issue/PR content enabling permission bypass and CI/CD secret exfiltration — the action's checkWritePermissions function trusted any GitHub App actor whose token name ended in [bot], allowing any self-registered GitHub App to bypass write-permission checks and inject prompt payloads via issue bodies; injected prompts trick Claude Code into reading /proc/self/environ (exposing ANTHROPIC_API_KEY, OIDC tokens, and all workflow secrets) then writing contents to a GitHub issue comment; attacker who captures the OIDC token can exchange it for a GitHub App installation token with full repository write access; because Anthropic's own claude-code-action repository used the same vulnerable workflow, a successful attack could have propagated malicious code to every downstream consumer

Fixed in

claude-code-action v1.0.94; Claude Code 2.1.128 (blocks /proc/self/environ access)

Mitigation

Update claude-code-action to >= v1.0.94; update Claude Code to >= 2.1.128; audit GitHub Actions workflows for indirect prompt injection via issue/PR bodies; restrict CI/CD secrets to necessary workflows only; use OIDC token scoping; prefer workflow_run trigger over pull_request_target

Source: Flatt Security / RyotaK (2026-06-01); Microsoft Security Blog (2026-06-05); THN (2026-06-05)

Cursor (agent terminal sandbox)

DuneSlide #1 — working-directory restriction bypass: the optional working_directory parameter on Cursor's run_terminal_cmd tool lets an AI agent write and run commands outside the intended workspace boundary, and overwriting the cursorsandbox binary turns sandboxed commands into unsandboxed OS-level RCE via zero-click prompt injection

Fixed in

Cursor Desktop 3.0 (working-directory fix shipped 2026-04-02)

Mitigation

Update Cursor to >= 3.0; audit agent terminal sessions for out-of-workspace command execution

Source: Cato AI Labs DuneSlide (2026-07-01); GitHub Security Advisory GHSA-8pcm-8jpx-hv8r; BitNinja (2026-06-26); THN (2026-07-02)

Cursor (agent terminal sandbox)

DuneSlide #2 — file-write escape via insecure symlink-resolution fallback: when the safety check on path canonicalization fails, Cursor trusts the shortcut's path, letting the agent write files (e.g. overwrite the sandbox binary) outside the project boundary. Also the Cursor instance of the GhostApproval symlink approval-box class.

Fixed in

Cursor Desktop 3.0 (link-target fix shipped 2026-06-01/05)

Mitigation

Update Cursor to >= 3.0; do not accept agent file-write approvals for symlinked paths

Source: Cato AI Labs DuneSlide (2026-07-01); GitHub Security Advisory GHSA-8pcm-8jpx-hv8r; Wiz GhostApproval (2026-07-08); THN (2026-07-02)

Cursor (workspace .claude/.cursor hook config)

Workspace-controlled hook configuration file turns into unsandboxed command execution: a repo ships a hook config that the editor trusts and runs outside the agent sandbox on next launch, part of a broader 'configuration-based sandbox escape' pattern (files the agent writes inside its sandbox get executed by host tooling later, without re-checking trust)

Fixed in

Cursor 3.0.0

Mitigation

Update Cursor to >= 3.0.0; treat repo-provided hook/config files as untrusted until reviewed; do not let host tooling (Python extension, git hooks) auto-run files an agent wrote inside its own sandbox

Source: Pillar Security - Week of Sandbox Escapes (2026-07); BleepingComputer (2026-07)

Amazon Q Developer (VS Code extension / language server)

GhostApproval — symlink-based approval-box spoofing: a booby-trapped repository ships an innocent-looking file (e.g. project_settings.json) that is actually a symlink to a sensitive location (e.g. ~/.ssh/authorized_keys). When the developer asks the agent to set up the environment, it follows the link and writes attacker-supplied content (such as a public SSH key granting persistent passwordless access) outside the workspace, while the confirmation dialog shows a benign in-project path

Fixed in

Amazon Q language server 1.69.0 (2026-05-27)

Mitigation

Update Amazon Q language server to >= 1.69.0; never accept agent file-write approvals for symlinked paths; audit cloned repos for symlinks pointing outside the project before running setup

Source: Wiz GhostApproval (2026-07-08); AWS security bulletin; THN (2026-07-08)

Amazon Q Developer

Poisoned repository auto-loads a workspace config file and runs commands to steal a developer's AWS credentials once the workspace is trusted

Fixed in

Amazon Q language server 1.69.0 (2026-05-27)

Mitigation

Update to >= 1.69.0; do not auto-trust cloned workspaces; scope AWS credentials to least privilege and rotate if a poisoned repo was opened

Source: Wiz GhostApproval (2026-07-08); AWS security bulletin

FastMCP (OpenAPIProvider)

SSRF and path traversal via unencoded URL templates in OpenAPIProvider tool generation

Fixed in

See GHSA-vv7q-7jx5-f767 for patched version

Mitigation

Update FastMCP to the patched release; sanitize/encode URL template parameters before use

Source: GitHub Advisory GHSA-vv7q-7jx5-f767

LibreChat (MCP access control)

MCP access-control and environment-variable injection vulnerabilities in LibreChat's MCP integration

Fixed in

See vendor advisory for patched version

Mitigation

Update LibreChat to the patched release; audit MCP server configuration for injectable environment variables

Source: Threat-Modeling.com (2026-06-02)

@modelcontextprotocol/sdk (TypeScript)

ReDoS (regular expression denial of service) via resource template arrays

Fixed in

See GHSA-8r9q-7v3j-jr4g for patched version

Mitigation

Update @modelcontextprotocol/sdk to the patched release; validate/limit resource template array sizes

Source: GitHub Advisory GHSA-8r9q-7v3j-jr4g

Claude Code (WebFetch tool, pre-approved huggingface.co hostname)

huggingface.co was allowlisted as a bare hostname for WebFetch, so every path on that domain, including attacker-created model repositories, was fetched with no permission prompt. Novee turned Hugging Face's public download counter into an exfiltration oracle: 64 attacker-created repos, one per possible character, and the counter that increments tells the attacker which character came next. An API key leaves one character per request, entirely over a pre-trusted domain.

Fixed in

Claude Code 2.1.163

Mitigation

Upgrade to >= 2.1.163. Independently of the patch, audit your own WebFetch and permission allowlists for bare hostnames: any domain that lets an attacker create content and read back a public counter is an exfiltration channel, not just a fetch target. Prefer path-scoped entries over bare hostnames.

Source: Novee Security (Elad Meged) at Black Hat USA 2026, 2026-08-05; CSA research note (2026-08-07); The Hacker News (2026-08-07)

Google Gemini CLI + run-gemini-cli GitHub Action (container launcher)

OS command injection in the container launcher reached through a crafted .gemini/.env file. In headless CI the workspace is trusted automatically, so a .env shipped in an untrusted pull request is loaded as legitimate configuration and executes OS commands on the CI host BEFORE the sandbox initialises. A chained flaw let the agent read a sibling process's unredacted environment via /proc/[PID]/environ and push a backdoored commit through a dispatched second workflow with write access.

Fixed in

Gemini CLI 0.39.1 (or 0.40.0-preview.3); run-gemini-cli 0.1.22

Mitigation

Upgrade both the CLI and the Action, because patching one leaves the path open. Never let an agent run in headless CI with automatic workspace trust on untrusted pull requests. Enforce tool allowlists at execution time, not only at registration: this bug existed because registration checked the allowlist and execution never did.

Source: Novee Security at Black Hat USA 2026 (2026-08-05); CSA research note (2026-08-08); GHSA-wpqr-6v78-jr5g

MCP Ruby SDK (mcp gem, StreamableHTTPTransport + legacy SSE transport)

Session IDs are not bound to a session owner. An attacker holding a stolen session ID sends tools/call requests through /messages/{session-id} that execute in the victim's session, with responses delivered to the legitimate user's SSE stream. Silent by design: the victim's session performs attacker actions with no visible signal.

Fixed in

mcp gem 0.23.0

Mitigation

Upgrade the mcp gem to >= 0.23.0. Until then, require an authentication token on every request and reject any request whose session ID does not match the authenticated principal.

Source: MCP Ruby SDK security advisories (2026-07-08 published, NVD 2026-07-29); Tenable; Rapid7; GitLab advisory database

MCP Ruby SDK (mcp gem, StreamableHTTPTransport)

Unbounded JSON-RPC request body, read BEFORE authentication checks run. The advisory documents a single 512 MB request driving process memory from 44 MB to 1.66 GB. Unauthenticated attackers can exhaust host memory.

Fixed in

mcp gem 0.23.0

Mitigation

Upgrade to >= 0.23.0. Put a reverse proxy in front that caps request body size, and run MCP hosts under a memory-limited cgroup or container so exhaustion kills the container rather than the host.

Source: MCP Ruby SDK security advisories (2026-07-08); NVD (2026-07-29)

MCP Ruby SDK (mcp gem, StreamableHTTPTransport)

The Rack-mountable Streamable HTTP transport processes every JSON-RPC request without inspecting the HTTP Host or Origin header. No AllowedHosts, no AllowedOrigins, no DNS-rebinding guard. A malicious web page rebinds its own hostname to 127.0.0.1, then drives the victim's local MCP server cross-origin to enumerate tools, invoke them, and read the output back.

Fixed in

mcp gem 0.23.0

Mitigation

Upgrade to >= 0.23.0. Bind to 127.0.0.1 explicitly, or front the server with a reverse proxy that validates Host. Requiring a token per request also works, because a browser cannot read a token cross-origin.

Source: SentinelOne (2026-07-30); GitLab advisory database; NVD (2026-07-29)

MCP Ruby SDK (mcp gem, StdioTransport + Client::Stdio)

Both stdio transports call IO#gets with no byte limit. A peer that sends data without a terminating newline forces the process to accumulate bytes until the host runs out of memory and the process is OOM-killed.

Fixed in

mcp gem 0.23.0 (adds a max_line_bytes parameter, default 4 MiB)

Mitigation

Upgrade to >= 0.23.0. Restrict which local executables can be launched as MCP stdio peers, and cap memory per host process.

Source: SentinelOne (2026-07-30); offseq radar; NVD (2026-07-29); GHSA-7683-3w9x-ch42

MCP Ruby SDK (mcp gem, StreamableHTTPTransport)

Sessions never expire by default, so repeated initialize requests retain unbounded ServerSession objects until process memory is exhausted.

Fixed in

mcp gem 0.23.0

Mitigation

Upgrade to >= 0.23.0 and configure session expiry explicitly.

Source: Tenable (2026-07-30); NVD (2026-07-29)

Jane-xiaoer/skill-vision-control 1.3.0 (config.ts getSkillVersionsDir)

Path traversal via the skillName argument, escaping the intended skill versions directory

Fixed in

unpatched as of 2026-08-17, maintainer has not responded to disclosure

Mitigation

Do not install; if already installed, treat any caller-supplied skill name as hostile and validate against a fixed allowlist

Source: VulDB via NVD (2026-08-09); 0dayNews wave summary

aktsmm/skill-ninja-mcp-server 0.1.0 (installer.ts uninstallSkill)

Path traversal via workspacePath in the functions that install, update and remove skills and modify AGENTS.md. A server whose whole job is writing agent instruction files, with an unvalidated path argument.

Fixed in

0.1.1

Mitigation

Upgrade to 0.1.1. Also review AGENTS.md history in any repo this server touched, since the same argument that traverses paths writes agent instructions.

Source: VulDB via NVD (2026-08-09); Breachroad analysis

abracadabra50/claude-sesh (enricher.ts enrichSession)

Path traversal in session enrichment, reachable through the session data the tool reads

Fixed in

unconfirmed, check upstream

Mitigation

Avoid until patched; a session-reading MCP server runs with access to your Claude Code transcripts

Source: VulDB via NVD (2026-08-09)

andreahaku/codex_mcp (codex-process-simple.ts, 'ask' MCP tool)

Command injection through the ask tool's argument handling

Fixed in

unconfirmed, check upstream

Mitigation

Avoid until patched

Source: VulDB via NVD (2026-08-09)

NightTrek/Ollama-mcp (index.ts)

Command injection in the Ollama MCP bridge

Fixed in

unconfirmed, check upstream

Mitigation

Avoid until patched; prefer the official Ollama integration path

Source: VulDB via NVD (2026-08-09)

Pimzino/spec-workflow-mcp 2.2.0-2.2.6 (approvals.ts ApprovalStorage.createApproval)

Path traversal via the categoryName argument when writing approval records

Fixed in

2.2.7

Mitigation

Upgrade to >= 2.2.7

Source: VulDB via NVD (2026-08-09), patch commit 9c7a7839

adenot/mcp-google-search <= 0.3.1 (read_webpage tool)

SSRF via the url argument in read_webpage: a controlled URL directs the request at anything the MCP host can reach

Fixed in

patch commit f071d491, no tagged release named in the advisory; verify your installed copy contains it

Mitigation

The fix is the right template for any URL-taking tool: restrict protocols to HTTP/HTTPS, resolve DNS, block private, loopback, link-local and multicast v4/v6 ranges, and disable automatic redirects

Source: VulDB via NVD (2026-08-09)

aliyun/alibabacloud-dataworks-mcp-server 1.0.0-1.0.43 (ReadResourceRequestSchema)

SSRF via request.params.uri, classified as remotely exploitable, unusual in this wave, where nearly everything else needs local access

Fixed in

unpatched as of 2026-08-17, project did not respond to the earlier report

Mitigation

Disable the tool and restrict egress from the MCP host. SSRF from an agent tool reaches localhost panels, private-network services and cloud metadata endpoints that trust the host's address.

Source: VulDB via NVD (2026-08-09)

KS-GEN-AI/jira-mcp-server 0.2.0 (add_attachment_from_public_url, axios.get)

SSRF via the imageUrl argument

Fixed in

unpatched as of 2026-08-17, project informed via issue report and no response

Mitigation

Disable the attachment-from-URL tool; restrict MCP host egress

Source: VulDB via NVD (2026-08-09); Tenable

AstrBot (MCP Test Endpoint)

SSRF via ToolsRoute.test_mcp_connection: the mcp_server_config.url parameter is not validated, letting a remote attacker make AstrBot issue HTTP requests to internal or arbitrary external targets

Fixed in

unconfirmed — check upstream release notes for the first release after 4.25.2; no patched version explicitly stated in public advisories as of this update

Mitigation

Do not expose the MCP Test Endpoint to untrusted networks; restrict mcp_server_config.url to an allowlist of internal hosts pending a confirmed patched version

Source: cvefeed.io; secnews.gr (disclosed 2026-07-12)

SiYuan (asset.upload MCP tool)

Path traversal in the asset.upload MCP tool — accepts arbitrary absolute file paths without workspace boundary validation; a prompt-injected instruction can direct the built-in AI agent to copy sensitive files such as SSH keys or credentials from outside the workspace into the asset directory

Fixed in

3.8.1

Mitigation

Upgrade SiYuan to >= 3.8.1; do not grant the AI agent access to untrusted prompts while asset.upload is reachable on an older version

Source: GHSA-p23f-cm6q-2qp8 / NVD (2026-08-28)

MCP PHP SDK (Composer package mcp/sdk, HttpTransport)

Unbounded in-memory buffer growth in the SSE-consuming HttpTransport — incoming Server-Sent Events chunks are appended to a buffer with no upper bound and flushed only on the event delimiter, so a malicious, compromised, or man-in-the-middle MCP server that withholds the delimiter exhausts client process memory and causes denial of service

Fixed in

0.7.1

Mitigation

Upgrade mcp/sdk to >= 0.7.1; do not point HttpTransport at untrusted or unauthenticated MCP server endpoints

Source: GHSA-7m52-jw36-44r3 / NVD (2026-08-25)