Claude Code CVE Database

Claude Code (September permission and plugin fixes)

September releases correct permission path checks, managed-policy failure handling, plugin path containment, archive permissions and secret exposure in diagnostic output.

Fixed in

2.1.269 includes the reviewed fixes

Mitigation

Update to 2.1.269 or later and review permission rules and installed plugin provenance.

Source: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

Visual Studio Code (Nested configuration Restricted Mode bypass)

Restricted workspace settings expressed as nested objects can take effect without workspace trust, allowing settings intended to remain blocked.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-q2f8-hh8x-wpc2

Visual Studio Code (Agent URL authority and domain policy bypass)

Agent web and browser tools can bypass denied destinations through inconsistent URL parsing or ignored valid administrator patterns when network filtering is enabled.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-hr37-8jwr-q8p8

Visual Studio Code (Webview resource root escape)

A webview using non-file resource schemes can exploit inconsistent separator handling to read content outside the extension's allowed resource roots.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-x5qc-gqm7-93qp

Visual Studio Code (Copilot Chat ADO token endpoint override)

Repository settings can redirect authenticated Azure DevOps Code Search requests to an attacker endpoint and expose the user's token.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-rvgr-2w56-2j67

Visual Studio Code (Chat remote media request before filtering)

Rendering agent-provided remote media can initiate a request before the chat policy removes the element, potentially leaking data encoded in its URL, including on history restoration.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-vww8-mqc2-4x8v

Visual Studio Code (MCP gallery metadata path traversal)

Installing or updating attacker-controlled MCP gallery metadata can write beyond per-server storage; uninstalling the entry can delete an unintended directory.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-g6p5-6xp8-5jwg

Visual Studio Code (Mapped IPv6 deny-only policy bypass)

With agent filtering enabled, an IPv4 deny entry and an empty allow list, an equivalent mapped IPv6 address can bypass the denied destination.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-4xcg-6mm5-hj26

Visual Studio Code (Browser URL separator network bypass)

With agent filtering and browser chat tools enabled, URL separator interpretation differs between policy validation and browser navigation, permitting requests to restricted hosts.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-4gv7-q2x8-32p8

Visual Studio Code (Workspace remote agent host permissions)

Workspace settings can choose a remote agent host and grant it local-file access, enabling data access or code execution when the crafted repository is opened.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-2cmq-rv52-5rf6

Visual Studio Code (Workspace Trust service bypass)

An untrusted workspace can connect to attacker-controlled services and bypass restrictions without the user granting workspace trust.

Fixed in

1.136.2

Mitigation

Update Visual Studio Code to 1.136.2 or later.

Source: https://github.com/microsoft/vscode/security/advisories/GHSA-r2gr-w3c8-wvqv

Goose CLI (goose review)

Review context collection invokes Git with repository-controlled fsmonitor configuration, allowing host command execution before the model or tool approval flow runs.

Fixed in

1.44.0

Mitigation

Upgrade to 1.44.0 or later; review the provenance of folders delivered with Git metadata.

Source: https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r

FrontMCP, @frontmcp/adapters and mcp-from-openapi

Loading an untrusted OpenAPI specification can reach private endpoints through external references that bypass the earlier SSRF fix. Deployment exposure depends on who can supply adapter specifications.

Fixed in

frontmcp/@frontmcp/adapters 1.5.0; mcp-from-openapi 2.5.0

Mitigation

Upgrade the affected packages; disable external references for untrusted specifications where possible.

Source: https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c

mysql-mcp-server (SSE transport)

SSE transport lacks Origin/Host validation and request authentication, permitting SQL execution with the configured database account. Default stdio transport is unaffected.

Fixed in

0.4.2

Mitigation

Upgrade to 0.4.2 or later; restrict network exposure and database privileges.

Source: https://github.com/designcomputer/mysql_mcp_server/security/advisories/GHSA-rqfv-2mw9-78g2

awslabs.dynamodb-mcp-server (CDK generator)

Crafted table, index or attribute names in an untrusted data model can inject code into generated CDK output, executed by the host deploying the application.

Fixed in

2.1.6

Mitigation

Upgrade to 2.1.6 or later and review untrusted data models before generating or deploying CDK output.

Source: https://aws.amazon.com/security/security-bulletins/2026-097-aws/

Filesystem MCP Server

Symlink escape to arbitrary filesystem access / potential LPE

Fixed in

0.6.3 / 2025.7.1

Mitigation

Update to >= 0.6.3; avoid Filesystem MCP in sensitive environments

Source: Cymulate EscapeRoute

Filesystem MCP Server

Naive prefix-match directory bypass (startsWith on paths)

Fixed in

0.6.3 / 2025.7.1

Mitigation

Update to >= 0.6.3

Source: Cymulate EscapeRoute

MCP Inspector

RCE via unauthenticated proxy on 0.0.0.0; drive-by RCE from malicious web page

Fixed in

0.14.1

Mitigation

Update to >= 0.14.1; restrict to localhost

Source: Recorded Future / SocRadar

MCP Git Server (mcp-server-git)

git_init path traversal — arbitrary filesystem path for repo creation

Fixed in

2025.9.25

Mitigation

Update; restrict Git MCP to trusted repos

Source: The Hacker News / PointGuard AI

MCP Git Server (mcp-server-git)

Argument injection in git_diff/git_checkout — shell metacharacters via user-controlled args

Fixed in

2025.12.18

Mitigation

Update; sanitize all user inputs to git CLI

Source: The Hacker News / PointGuard AI

MCP Git Server (mcp-server-git)

--repository path validation bypass — access beyond allowlist

Fixed in

2025.12.18

Mitigation

Update; enforce strict path validation

Source: The Hacker News / PointGuard AI

MCP Python SDK (mcp on PyPI)

DNS rebinding to local HTTP MCP servers when using FastMCP HTTP/SSE with no auth

Fixed in

1.23.0

Mitigation

Update to >= 1.23.0; enable TransportSecuritySettings explicitly

Source: Debian Security Tracker

MCP Python SDK (mcp on PyPI)

Missing Host/Origin validation on the deprecated WebSocket server transport (mcp.server.websocket.websocket_server); a hostile web page can drive a user's local MCP server via a cross-site WebSocket connection (DNS rebinding / cross-site WS hijack), bypassing authentication

Fixed in

1.28.1

Mitigation

Update to >= 1.28.1; stop using the deprecated websocket_server transport

Source: SentinelOne; Tenable; NVD (published 2026-07-15)

MCP Python SDK (mcp on PyPI)

SseServerTransport / StreamableHTTPSessionManager route messages by session_id query param or Mcp-Session-Id header alone, without verifying the authenticated principal owns that session; a second bearer-token-authenticated client that knows a session ID can inject JSON-RPC messages into it (session hijacking)

Fixed in

1.27.2

Mitigation

Update to >= 1.27.2

Source: NVD / OpenCVE

MCP Python SDK (mcp on PyPI)

Experimental task API (server.experimental.enable_tasks()) tracks tasks.list/get/result/cancel by task ID only, not by the session that created them; any connected client can enumerate or consume another client's tasks (cross-session data exposure)

Fixed in

1.27.2

Mitigation

Update to >= 1.27.2; disable experimental task handlers unless required

Source: NVD

MCP Gateway

DNS rebinding against SSE/streaming listeners — indirect access to MCP servers behind gateway

Fixed in

0.28.0

Mitigation

Update to > 0.27.0

Source: Blog Gowrishankar

MCP TypeScript SDK

Cross-client response data leak when reusing single server+transport across multiple SSE clients

Fixed in

1.26.0

Mitigation

Update to >= 1.26.0; isolate transport instances per client

Source: Feedly CVE

Cursor IDE

CurXecute — RCE via prompt injection writing .cursor/mcp.json

Fixed in

1.3.9

Mitigation

Update to Cursor >= 1.3.9; file integrity monitoring on mcp.json

Source: Checkpoint / PropelCode

Cursor IDE

MCPoison — persistent RCE via trusted config mutation; post-approval changes auto-execute

Fixed in

1.3.9

Mitigation

Update to >= 1.3.9; Git hooks + hash verification on mcp.json

Source: Checkpoint

Claude Code

8 command execution bypasses via blocklist flaws (man --html, sed e modifier, git arg ambiguity, bash variable expansion)

Fixed in

1.0.93

Mitigation

Update to Claude Code >= 1.0.93

Source: Flatt Security

Claude Code WebFetch

SSRF via startsWith() domain validation bypass in WebFetch (trusted-domain prefix attack)

Fixed in

1.0.111

Mitigation

Update to Claude Code >= 1.0.111

Source: SentinelOne

Claude Code

RCE via enableAllProjectMcpServers config — malicious .claude/settings.json or .mcp.json sets flag to auto-start MCP servers before trust dialog is shown; injected commands execute immediately upon claude startup in untrusted directory

Fixed in

1.0.111

Mitigation

Update to Claude Code >= 1.0.111; never run claude in untrusted repositories without reviewing config files first

Source: Check Point Research (2026-02-25)

Claude Code

API key exfiltration via ANTHROPIC_BASE_URL in malicious repository config — attacker sets ANTHROPIC_BASE_URL to attacker-controlled server in .claude/settings.json; Claude Code sends API requests (including bearer API key) before trust dialog is presented

Fixed in

2.0.65

Mitigation

Update to Claude Code >= 2.0.65; inspect .claude/settings.json and .mcp.json before opening unfamiliar repos

Source: Check Point Research (2026-02-25)

Claude Code

Sandbox bypass — commands excluded from sandboxing could bypass Bash permission enforcement (details undisclosed)

Fixed in

2.1.34

Mitigation

Update to Claude Code >= 2.1.34

Source: Claude Code CHANGELOG v2.1.34

Framelink Figma MCP Server (figma-developer-mcp)

Command injection via unsanitized input in fetchWithRetry curl command

Fixed in

0.6.3

Mitigation

Update to >= 0.6.3

Source: Geordie AI / EndorLabs

Microsoft Playwright MCP Server (@playwright/mcp)

DNS rebinding / Origin-less CSRF — missing Origin validation on local instance

Fixed in

0.0.40

Mitigation

Update to >= 0.0.40

Source: Mondoo / NVD

MCP SSE Transport (oatpp-mcp)

Prompt hijacking via predictable/reused session IDs; attacker replaces tool outputs

Fixed in

Unknown

Mitigation

Use cryptographically secure session IDs (128+ bits entropy)

Source: JFrog

Godot MCP Server (godot-mcp)

Command injection via user-controlled projectPath passed to exec()

Fixed in

0.1.1

Mitigation

Update to >= 0.1.1; sanitize projectPath; avoid exec() with user input

Source: Feedly CVE

mcp-package-docs

Command injection in child_process.exec via unsanitized input

Fixed in

0.1.28

Mitigation

Update to >= 0.1.28

Source: NVD

MCPJam Inspector

RCE via crafted HTTP request that triggers automatic MCP server installation; allows remote attacker to execute arbitrary code on developer machine

Fixed in

1.4.3

Mitigation

Update MCPJam Inspector to >= 1.4.3; restrict to localhost; do not expose MCPJam to untrusted networks

Source: Immersive Labs / CVE-2026-23744

xcode-mcp-server (r-huijts)

Command injection in registerXcodeTools function via unsanitized args argument passed to exec(); allows RCE or data exfiltration

Fixed in

after commit f3419f00117aa9949e326f78cc940166c88f18cb

Mitigation

Update to latest commit post-f3419f00; avoid passing user-controlled input to exec(); switch to execFile() with argument arrays

Source: SentinelOne

gemini-mcp-tool

Command injection via LLM-generated arguments passed directly to shell execution primitives without validation; network-reachable RCE via JSON-RPC CallTool requests requiring no authentication and no user interaction

Fixed in

no fix confirmed at time of research (2026-02-22)

Mitigation

Replace shell string execution with execFile() and argument arrays; validate all LLM-generated arguments before passing to any exec primitive; do not expose gemini-mcp-tool to untrusted networks

Source: Penligent AI

mcp-run-python

SSRF via overly permissive Deno sandbox configuration — sandbox allows localhost interface access, enabling attackers to reach internal network resources through crafted Python code execution requests

Fixed in

unknown — check upstream for patch

Mitigation

Restrict Deno sandbox network permissions to block localhost/internal ranges; do not expose mcp-run-python to untrusted inputs or external networks

Source: Snyk (2026-02-09)

MCP Salesforce Connector

Arbitrary attribute access — prior to 0.1.10, attacker can access arbitrary object attributes via crafted MCP requests, potentially exposing sensitive Salesforce data

Fixed in

0.1.10

Mitigation

Update MCP Salesforce Connector to >= 0.1.10; enforce attribute allowlists

Source: NVD

sf-mcp-server (Salesforce MCP)

Command injection via unsafe child_process.exec when constructing Salesforce CLI commands with user-controlled input; allows arbitrary code execution on the host

Fixed in

unknown — check upstream

Mitigation

Replace child_process.exec with execFile() and sanitize all user-controlled inputs; avoid sf-mcp-server until patched

Source: NVD (2026-02-11)

eBay API MCP Server (open-source)

Environment variable injection via updateEnvFile function in ebay_set_user_tokens tool — all versions vulnerable; attacker can inject arbitrary env variables to the .env file

Fixed in

no fix confirmed

Mitigation

Sanitize all inputs to updateEnvFile; do not expose eBay MCP Server to untrusted inputs

Source: CVEDetails (2026-02-20)

MCP Git Server (mcp-server-git)

Path traversal in git_add tool — unsafe GitPython repo.index.add() call without path boundary validation allows staging/committing files outside repo (e.g. /etc/shadow, ~/.ssh/id_rsa); attacker or confused LLM can exfiltrate sensitive host files via a commit push

Fixed in

2026.1.14

Mitigation

Update mcp-server-git to >= 2026.1.14; audit recent git commits managed by agents for unexpected file paths

Source: NVD / dev.to (2026-02-26)

OpenClaw (aka clawdbot, Moltbot)

Authentication token theft and RCE via malicious gatewayUrl — OpenClaw automatically establishes a WebSocket connection to a URL provided in the query string without origin validation; clicking attacker-crafted link causes OpenClaw to transmit auth token to attacker-controlled server; attacker replays token for full system access. 17,500+ internet-exposed instances identified.

Fixed in

2026.1.29

Mitigation

Update OpenClaw to >= 2026.1.29; block public internet exposure of OpenClaw instances

Source: SonicWall / Hunt.io / runZero (2026-02-03 to 2026-02-26)

Claude Code

Sandbox escape via persistent configuration injection — bubblewrap sandbox failed to protect missing .claude/settings.json; malicious code running inside sandbox creates settings.json with SessionStart hooks that execute with host privileges after Claude Code restart

Fixed in

2.1.2

Mitigation

Update Claude Code to >= 2.1.34 (covers this and subsequent fixes); monitor .claude/settings.json for unexpected SessionStart hooks

Source: NVD / GHSA-ff64-7w26-62rf (2026-02-06)

MCP Manager for Claude Desktop

Command injection sandbox escape — execute-command functionality fails to sanitize user-supplied strings from MCP config objects before passing to system calls; attacker crafts malicious webpage with injected config objects, causing MCP Manager to execute arbitrary commands outside the sandbox

Fixed in

unknown — check upstream

Mitigation

Restrict MCP Manager access to trusted configurations only; sanitize all MCP config object fields before system calls; block untrusted file/webpage access

Source: NVD / ZDI-CAN-27810 (2026-01-22)

HexStrike AI MCP Server (0x4m4)

Command injection via semicolon-prefixed argument — EnhancedCommandExecutor class fails to sanitize command-line arguments; attacker provides argument beginning with ; to API endpoint, executing arbitrary commands with MCP server privileges (typically root in default config)

Fixed in

no fix confirmed at time of research

Mitigation

Sanitize all command-line arguments; replace exec()-style calls with execFile() with argument arrays; do not expose HexStrike AI MCP Server to untrusted networks or inputs

Source: Check Point Advisories / NVD (2025-11-30)

nmap-mcp-server (PhialsBasement)

Command injection in Nmap CLI Command Handler — child_process.exec in src/index.ts processes special elements (CWE-74/CWE-77) without sanitization; remotely exploitable with no authentication required

Fixed in

patch commit 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488

Mitigation

Apply patch commit 30a6b9e...; replace child_process.exec with execFile() and argument arrays; sanitize all nmap arguments

Source: NVD / PT Security (2026-03-04)

Azure MCP Server Tools (Microsoft Azure)

SSRF leading to managed identity token theft and privilege escalation — attacker sends crafted input to exposed Azure MCP Server endpoint; server forwards request to attacker-controlled URL including its managed identity token; attacker captures token and gains all permissions associated with the MCP server's managed identity (can reach Azure resources, management APIs, subscriptions)

Fixed in

March 10, 2026 Patch Tuesday update

Mitigation

Apply Microsoft March 2026 security update; restrict Azure MCP Server endpoints to trusted callers; audit managed identity permissions (principle of least privilege); monitor for unexpected outbound requests from MCP server processes

Source: Microsoft Patch Tuesday March 2026 / Tenable / The Hacker News (2026-03-10)

quip-mcp-server (version 1.0.0)

Command injection in setupToolHandlers function — fails to sanitize user input before passing to system commands; allows remote attackers with low privileges to execute arbitrary commands on the underlying system

Fixed in

no fix available at time of disclosure — maintainers unresponsive

Mitigation

Avoid quip-mcp-server until patched; replace with sanitized alternatives; do not expose to untrusted networks

Source: SentinelOne (2026-03-19)

mcp-server-auto-commit (version 1.0.0)

Command injection in getGitChanges function in index.ts — unsanitized user input passed to shell commands; requires local access to exploit

Fixed in

commit f7d992c830c5f2ec5749852e66c0195e3ed7fe30

Mitigation

Apply patch commit f7d992c...; replace exec() with execFile() and argument arrays

Source: SentinelOne (2026-03-19)

MCP Go SDK (go-sdk) Streamable HTTP transport

CSRF vulnerability in Streamable HTTP transport — cross-site POST requests with text/plain content-type trigger arbitrary tool execution on local MCP servers without user interaction

Fixed in

check upstream for patch

Mitigation

Restrict MCP Go SDK HTTP servers to localhost with proper Origin validation; prefer stdio transport for local deployments; update to latest version

Source: Miggo.io (2026-03-22)

AWS API MCP Server (versions 0.2.14 through 1.3.9)

Improper Protection of Alternate Path — attacker bypasses file access restrictions in no-access and workdir features, potentially exposing configuration files and credentials on local filesystem; requires local access, no authentication needed

Fixed in

1.4.0 or later

Mitigation

Update AWS API MCP Server to >= 1.4.0; restrict MCP server to trusted local users only; audit file access permissions post-update

Source: SentinelOne (2026-03-19)

MCP Atlassian (mcp-atlassian, Confluence and Jira)

Unauthenticated SSRF via header injection — prior to version 0.17.0, attacker can forge server-side requests to internal Atlassian or adjacent network resources without authentication

Fixed in

0.17.0

Mitigation

Update mcp-atlassian to >= 0.17.0; restrict MCP Atlassian to trusted networks; audit outbound requests from Atlassian MCP server

Source: Miggo.io (2026-03-11); Rogue Security MCPwnfluence chain analysis (2026-03-23)

MCP Atlassian (mcp-atlassian)

Unrestricted file write in mcp-atlassian — chains with CVE-2026-27826 (SSRF) for full unauthenticated RCE as root via MCPwnfluence attack chain; requires only two HTTP requests from local network; no authentication needed

Fixed in

0.17.0

Mitigation

Update mcp-atlassian to >= 0.17.0; do not expose MCP Atlassian on public or untrusted networks; monitor for unexpected file writes

Source: Pluto Security / Rogue Security MCPwnfluence (2026-03-23)

Srmorete adb-mcp (ADB MCP Server, Node.js)

Command injection in ADB MCP Server versions 0.1.0 and prior — user-controlled input in tool definitions passed to system commands via string concatenation without sanitization; shell metacharacters (;, |, &&, $(), backticks) enable arbitrary command execution with MCP server process privileges; network-accessible, no authentication required, low complexity

Fixed in

commit 041729c or later

Mitigation

Update adb-mcp to patched version (commit 041729c+); restrict network access to trusted sources only; implement WAF with command injection rules; audit logs for exploitation attempts

Source: NVD (2025-09-25); SentinelOne (2026-03-24)

mcp-memory-service (multi-agent memory backend, Python)

Critical CORS misconfiguration in mcp-memory-service prior to 10.25.1 — when HTTP server enabled (MCP_HTTP_ENABLED=true), overly permissive CORS settings (allow_origins=['*'], allow_credentials=True) allow any website to read API responses cross-origin, enabling cross-origin memory theft and unauthorized access to agent memory stores

Fixed in

10.25.1

Mitigation

Upgrade mcp-memory-service to >= 10.25.1; set MCP_HTTP_ENABLED=false if HTTP not required; restrict CORS origins to trusted domains; never expose memory service endpoints to public networks

Source: SentinelOne / integsec.com (2026-03-27)

MCP Ruby SDK (mcp gem, streamable_http_transport.rb)

Session hijacking vulnerability in MCP Ruby SDK prior to 0.9.2 — streamable_http_transport.rb lacks sufficient session binding; attackers obtaining a valid session ID can intercept all real-time data from Server-Sent Events (SSE) streams, exfiltrating tool responses and agent outputs

Fixed in

0.9.2

Mitigation

Update MCP Ruby SDK (mcp gem) to >= 0.9.2; bind SSE sessions to client IP and additional entropy; use short-lived session tokens; prefer stdio transport over HTTP when possible

Source: Tenable CVE / GitLab Security Advisories (2026-03-27)

agentfront enclave (JavaScript sandbox for AI agent code execution)

Sandbox escape in agentfront enclave prior to version 2.11.1 — improper control of code generation allows escape from the secure JavaScript sandbox designed for safe AI agent code execution; enables arbitrary code execution outside the sandboxed environment

Fixed in

2.11.1

Mitigation

Update agentfront enclave to >= 2.11.1; apply defense-in-depth by adding OS-level sandboxing (Docker, gVisor) around the sandbox process; do not rely solely on JS sandbox for isolation of untrusted code

Source: radar.offseq.com (2026-03-28)

Bun runtime (bun.sh)

Malicious npm packages can execute lifecycle scripts (postinstall) without validating source origin — allows supply chain payloads to run during npm install in Bun environments; affects developer machines using Bun as runtime

Fixed in

v1.3.5

Mitigation

Update Bun to >= 1.3.5; audit package postinstall hooks before running install; prefer lockfile-verified installs

Source: Security research (2026-03); referenced in Claude Code supply chain risk analysis

Framelink Figma MCP Server (figma-developer-mcp)

Command injection RCE via fetchWithRetry method — user-supplied input passed to system calls without sanitization of shell metacharacters; authentication not required; allows arbitrary code execution with MCP server service account privileges

Fixed in

latest patched version (see upstream)

Mitigation

Update Framelink Figma MCP Server to latest version; sanitize all user-supplied inputs; restrict MCP Server network access to trusted sources

Source: ZDI-25-1197 / SentinelOne (2025-12-29, NVD published 2026-01-23)

aws-mcp-server

Command injection via improper validation of the allowed commands list — remote attackers can execute arbitrary code without authentication by passing shell metacharacters in command arguments; vendor rejected initial report, published as 0-day advisory by ZDI

Fixed in

no vendor patch — treat as unpatched 0-day; avoid using aws-mcp-server in network-accessible environments

Mitigation

Do not expose aws-mcp-server to untrusted network access; use allowlists enforced at OS level; consider alternative AWS MCP implementations with active security support; monitor ZDI advisory for future vendor patch

Source: ZDI-26-246 (2026-03-30); vendor rejected initial report

LibreChat (versions 0.8.2-rc1 through 0.8.3-rc1)

Information disclosure via malicious MCP server — insufficient access control in MCP server header processing allows credential placeholders to resolve to victim user OAuth tokens rather than the server creator's credentials; malicious MCP server can exfiltrate OAuth tokens through HTTP headers

Fixed in

0.8.3-rc2 or later — check upstream

Mitigation

Update LibreChat to >= 0.8.3-rc2; do not add MCP servers from untrusted sources in LibreChat; audit all configured MCP servers for unexpected HTTP header handling

Source: SentinelOne (2026-04-03)

Go MCP SDK (HTTP-based MCP servers using StreamableHTTPHandler or SSEHandler)

DNS rebinding vulnerability in Go MCP SDK prior to 1.4.0 — HTTP-based MCP servers on localhost without authentication lack DNS rebinding protection; malicious websites can bypass same-origin policy via DNS rebinding attack to invoke MCP tools or access resources on the local MCP server using developer credentials

Fixed in

1.4.0

Mitigation

Update Go MCP SDK to >= 1.4.0; prefer stdio transport over HTTP for local MCP servers; implement Host header validation; add authentication to all HTTP-based MCP server endpoints; do not run HTTP MCP servers on localhost without auth

Source: NVD / Red Hat (2026-04-02)

a11y-mcp (accessibility MCP server, priyankark, up to 1.0.5)

Server-side request forgery in a11y-mcp versions up to 1.0.5 via A11yServer function in src/index.js — requires local initiation but allows requests to internal network resources through the accessibility scanning functionality

Fixed in

1.0.6

Mitigation

Update a11y-mcp to >= 1.0.6; restrict a11y-mcp network access to trusted targets; validate all URLs passed to A11yServer function

Source: Tenable / NVD (2026-04-02)

Apollo MCP Server (prior to version 1.7.0)

Missing Host header validation on incoming HTTP requests when using StreamableHTTP transport — allows DNS rebinding attacks that bypass same-origin policy and invoke tools or access resources on behalf of local users; risk is mitigated in deployments using authentication, network controls, or stdio transport

Fixed in

1.7.0

Mitigation

Update Apollo MCP Server to >= 1.7.0; prefer stdio transport over HTTP; implement Host header validation; add authentication to all HTTP-based MCP server endpoints; do not run HTTP MCP servers on localhost without auth

Source: NVD (2026-04-10)

runZero Platform (prior to version 4.0.260202.0)

Information disclosure (CWE-863: Incorrect Authorization) — MCP agents could access remediation and asset information from outside the authorized organization scope; cross-org data leakage through misconfigured MCP authorization boundaries

Fixed in

4.0.260202.0

Mitigation

Update runZero Platform to >= 4.0.260202.0; audit MCP agent permissions to ensure org-scope isolation; validate organization boundary enforcement after upgrade

Source: runZero advisory (2026-04-07)

mcp-server-taskwarrior (awwaiid, up to 1.0.1)

Command injection through the Identifier argument in server.setRequestHandler — requires local attack initiation but allows arbitrary command execution via unvalidated task identifier input passed to the shell

Fixed in

patched; update to latest version

Mitigation

Update mcp-server-taskwarrior to latest patched version; restrict server to trusted local environments; sanitize all task identifier inputs

Source: NVD (2026-04-09)

mcp-summarization-functions (Braffolk, up to 0.1.5)

Vulnerability in Braffolk mcp-summarization-functions up to version 0.1.5 — exact nature of the flaw is not yet fully documented; treat as unverified pending full disclosure

Fixed in

0.1.6 or later — update to latest version

Mitigation

Update mcp-summarization-functions to latest version; do not use in production until full advisory is published

Source: CVEDetails (2026-04-06)

n8n-MCP (MCP server for n8n workflow documentation)

Vulnerability in n8n-MCP, a Model Context Protocol server providing AI assistants with comprehensive access to n8n node documentation and operations — exact nature not yet fully disclosed; CVE record reserved

Fixed in

update to latest version

Mitigation

Update n8n-MCP to latest version; monitor CVE record for full advisory; restrict n8n-MCP to trusted environments

Source: CVE.org (2026-04-09)

FastMCP and FastMCP OAuthProxy

The OAuthProxy component used for GitHub OAuth authentication does not properly validate a user's consent after authentication — an attacker could leverage this flaw to bypass OAuth consent validation and gain unauthorized access to connected MCP tools using a victim's GitHub identity

Fixed in

update to patched version — check upstream FastMCP releases

Mitigation

Update FastMCP to latest patched version; audit OAuth flows in any MCP server using FastMCP OAuthProxy; implement additional server-side consent validation; monitor GitHub OAuth grant tokens for unexpected usage

Source: Red Hat Security Advisory (2026-04-06)

nginx-ui (MCP integration, /mcp_message endpoint)

Missing authentication middleware on the /mcp_message endpoint in nginx-ui's MCP integration — the /mcp_message handler lacks the AuthRequired() middleware present on the /mcp endpoint, allowing unauthenticated network-adjacent attackers to invoke all 12 MCP tools (including nginx_config_add with auto-reload) and achieve complete nginx server takeover in two HTTP requests. 2,689 publicly reachable instances confirmed exposed. Actively exploited in the wild since March 2026; added to VulnCheck KEV April 13, 2026.

Fixed in

v2.3.4 (released 2026-03-15)

Mitigation

Update nginx-ui to >= v2.3.4 immediately; restrict /mcp_message to localhost or trusted network; do not expose nginx-ui admin interfaces to untrusted networks; audit nginx configs for unauthorized modifications

Source: Pluto Security / Rapid7 / Picus Security (2026-04-15 to 2026-04-16)

nginx-ui (/api/backup endpoint)

Unauthenticated /api/backup endpoint in nginx-ui leaks encryption keys used to decrypt database backups, exposing user credentials, SSL private keys, and node_secret values stored in the nginx-ui configuration

Fixed in

v2.3.4

Mitigation

Update nginx-ui to >= v2.3.4; restrict admin interface to trusted networks; rotate all credentials stored in nginx-ui after any exposure

Source: Picus Security (2026-04-16)

MariaDB MCP server (SSE service)

Information disclosure vulnerability in MariaDB MCP server — the SSE (Server-Sent Events) service lacks proper user validation, allowing unauthenticated attackers to access sensitive MCP data including database connection information and query results streamed via the SSE endpoint

Fixed in

update to latest version — check upstream MariaDB MCP releases

Mitigation

Update MariaDB MCP to latest version; enforce authentication on all SSE endpoints; do not expose MariaDB MCP server to untrusted networks

Source: SentinelOne (2026-04-15)

Windsurf AI IDE (MCP integration)

Zero-click prompt injection in Windsurf's MCP integration — attacker crafts malicious prompts that developers copy and paste, causing the MCP agent to write malicious configuration entries and execute arbitrary commands without any user interaction; part of the broader OX Security STDIO design flaw research affecting 150M+ MCP SDK downloads

Fixed in

check upstream Windsurf releases

Mitigation

Update Windsurf to latest patched version; treat all copied prompts from untrusted sources as potentially adversarial; audit MCP server configurations after opening external repositories; sandbox MCP service execution

Source: OX Security (2026-04-15)

MCP STDIO interface (all SDK languages: Python, TypeScript, Java, Rust)

Architectural design flaw in Anthropic's Model Context Protocol STDIO interface — the SDK receives a configuration to start a tool, uses STDIO to run it, and performs no validation of input before executing commands on the operating system. Affects all major MCP SDKs and an estimated 200,000+ servers and 150M+ downloads. Anthropic has stated this is 'by design' and that input sanitization is the developer's responsibility. Enables arbitrary command execution in any application that integrates MCP without its own validation layer.

Fixed in

no vendor patch — Anthropic considers behavior by design

Mitigation

Validate and sanitize ALL user input before passing to MCP STDIO; run MCP services in sandboxes with restricted OS permissions; block public IP access to MCP services; treat all MCP configurations as untrusted; use only official MCP server directories; apply defense-in-depth with OS-level sandboxing

Source: OX Security (2026-04-15); The Register (2026-04-16)

LiteLLM (MCP SDK stdio transport)

Command injection via MCP SDK stdio transport in LiteLLM — StdioServerParameters executes the configured command even when it fails to produce a valid server handle, allowing arbitrary OS command execution when an attacker controls the command string via prompt injection or poisoned MCP marketplace configuration

Fixed in

patched — update LiteLLM to latest version

Mitigation

Update LiteLLM immediately; validate all MCP stdio command parameters; never derive MCP command strings from user-controlled input

Source: OX Security / LiteLLM (2026-04-15); CyberSecurityNews (2026-04-21)

Flowise (MCP STDIO integration)

Command injection via MCP STDIO interface in Flowise — attacker-controlled MCP configuration allows arbitrary OS command execution through the stdio transport layer without user interaction; discovered as part of OX Security's MCP STDIO architectural research

Fixed in

check upstream Flowise releases for patch

Mitigation

Update Flowise to latest version; sandbox MCP service execution; block public IP access to Flowise MCP endpoints; treat all MCP STDIO configurations as untrusted

Source: OX Security (2026-04-15); THN (2026-04-20)

Bisheng (MCP STDIO integration)

Command injection via MCP STDIO interface in Bisheng — arbitrary OS command execution through the stdio transport layer; discovered and patched as part of OX Security's MCP STDIO architectural research affecting the broader ecosystem

Fixed in

patched — update Bisheng to latest version

Mitigation

Update Bisheng immediately; validate all MCP command parameters at the application layer

Source: OX Security (2026-04-15); CyberSecurityNews (2026-04-21)

Serverless Framework (experimental MCP server feature)

Command injection RCE vulnerability in Serverless Framework's experimental MCP server feature — allows attackers to execute arbitrary system commands via maliciously crafted MCP requests to the Serverless CLI's MCP endpoint

Fixed in

check upstream Serverless Framework releases

Mitigation

Disable Serverless Framework experimental MCP server feature if not required; update to latest Serverless Framework version; do not expose the MCP endpoint to untrusted networks

Source: SentinelOne (2026-04-22)

Red Hat Ansible Automation Platform (AAP) MCP server

Unauthenticated remote log injection in the Red Hat AAP MCP server — an unauthenticated attacker can exploit a log injection vulnerability by sending specially crafted input to manipulate log entries, potentially poisoning audit trails or triggering downstream log processing vulnerabilities

Fixed in

check Red Hat AAP MCP server security errata

Mitigation

Apply Red Hat security errata for AAP MCP server; sanitize all MCP server log inputs; restrict MCP endpoint access to trusted networks only

Source: Red Hat Customer Portal (2026-04-17)

Claude Code CLI and Claude Agent SDK

OS command injection vulnerability in Claude Code CLI and Agent SDK — attackers craft malicious file paths containing shell metacharacters (e.g., $() or backticks) that are passed to system calls without sanitization, allowing arbitrary command execution with the privileges of the running agent

Fixed in

update Claude Code to latest version; see minimum_safe_versions

Mitigation

Update Claude Code to latest version; never process untrusted file paths without sanitization; restrict shell metacharacter input in file path arguments; run Claude Code with minimum required OS permissions

Source: SentinelOne (2026-04-10)

Anthropic Claude Code

Sandbox escape via symlink manipulation in Anthropic Claude Code — prior to version 2.1.64, Claude Code's sandbox implementation failed to prevent sandboxed processes from creating symbolic links pointing to locations outside the workspace directory; attackers can create crafted symlinks inside the sandbox that allow read or write access to arbitrary host filesystem paths. Part of a pair of RCE code paths documented by Sonar researchers (April 30, 2026); the second code path exploits how Claude Code reads and processes project configuration files on startup in untrusted directories.

Fixed in

2.1.64

Mitigation

Update Claude Code to >= 2.1.64 (or latest; see minimum_safe_versions); never run Claude Code in untrusted directories without reviewing project files first (CLAUDE.md, .mcp.json, .claude/settings.json); use --no-memory flag in untrusted contexts; treat project config files as executable code

Source: SentinelOne (2026-04-23); Sonar blog (2026-04-30)

Upsonic 0.71.6 (MCP server/task creation)

Remote code execution in Upsonic 0.71.6 — the application allows users to define MCP server configurations including command and arguments that are executed server-side without adequate validation; attackers with access to MCP configuration endpoints can achieve arbitrary command execution with service account privileges

Fixed in

update Upsonic to version after 0.71.6 — check upstream releases

Mitigation

Update Upsonic to latest version; restrict access to MCP server configuration interfaces; validate and sanitize all command parameters before execution; do not expose Upsonic configuration API to untrusted networks

Source: Red Hat Customer Portal (2026-04-16)

Sunwood-ai-labs command-executor-mcp-server (up to 0.1.0)

OS command injection in Sunwood-ai-labs command-executor-mcp-server up to version 0.1.0 — the execute_command function is vulnerable to command injection via unsanitized user-supplied input; a public exploit is available; vendor has not responded to disclosure

Fixed in

no vendor patch — treat as unpatched; avoid using this MCP server in any environment

Mitigation

Remove command-executor-mcp-server from all MCP configurations; do not run MCP servers with broad shell command execution capabilities without proper sandboxing and input validation; use alternative MCP servers with active security maintenance

Source: NVD / Tenable (2026-05-01)

TimBroddin astro-mcp-server (up to 1.1.1)

Security vulnerability in TimBroddin astro-mcp-server up to version 1.1.1 — the impacted function is in src/index.ts; exact nature not yet fully documented at time of writing

Fixed in

1.1.2 or later — update to latest version

Mitigation

Update astro-mcp-server to >= 1.1.2; monitor NVD entry for full advisory

Source: NVD (2026-05-01)

aws-mcp-server

Second command injection vulnerability in aws-mcp-server (ZDI-CAN-27969) — distinct from CVE-2026-5058 (ZDI-CAN-27968); both rated CVSS 9.8 unauthenticated RCE; vendor rejected reports for both CVEs and no patch is available for either

Fixed in

no vendor patch — both CVE-2026-5058 and CVE-2026-5059 are unpatched 0-days

Mitigation

Do not use aws-mcp-server in any network-accessible environment; use alternative AWS MCP implementations with active security support; apply OS-level command allowlists; monitor ZDI for future vendor engagement

Source: ZDI-26-246 (2026-03-30)

Apache Doris MCP Server (before 0.6.1)

Improper neutralization flaw in Apache Doris MCP Server query context handling — versions before 0.6.1 may allow execution of unintended SQL statements and bypass of access restrictions when attacker-controlled input is passed into query context; enables unauthorized data access and potential exfiltration via the MCP server's database interface

Fixed in

0.6.1 — update Apache Doris MCP Server immediately

Mitigation

Update to Apache Doris MCP Server >= 0.6.1; restrict MCP server access to trusted agent identities only; validate and parameterize all SQL query inputs; apply least-privilege database permissions to the MCP server service account

Source: NVD (2026-04-20)

Git MCP Server

Command injection vulnerability in Git MCP Server — attacker-controlled input passed to git operations without proper sanitization allows execution of arbitrary OS commands; enables full host compromise through the MCP interface

Fixed in

update to latest version — check upstream

Mitigation

Update Git MCP Server to latest patched version; restrict the MCP server to trusted localhost connections only; apply OS-level command sandboxing; use mcp-server-git 2026.1.14+ which addresses related path traversal (CVE-2026-27735)

Source: SentinelOne (2026-04-29)

LibreChat (STDIO MCP interface)

Command injection vulnerability in LibreChat's STDIO MCP interface — part of the systemic OX Security STDIO design flaw (ADVISORY-MCP-STDIO-2026-001); attacker-controlled external MCP server configuration can inject shell commands that execute with the privileges of the LibreChat process; separate from CVE-2026-31951 (LibreChat OAuth token exfiltration)

Fixed in

apply LibreChat patch for STDIO command injection — check upstream for patched release

Mitigation

Update LibreChat to patched version; validate and sanitize all External MCP Server command+args before passing to shell; do not allow untrusted users to configure MCP server commands; apply allowlisting for permitted MCP server executables

Source: OX Security MCP STDIO Advisory ADVISORY-MCP-STDIO-2026-001 (2026-04-15)

WeKnora (STDIO MCP interface)

Command injection vulnerability in WeKnora's STDIO MCP interface — part of the systemic OX Security STDIO design flaw (ADVISORY-MCP-STDIO-2026-001); attacker-controlled MCP server configuration injects OS commands executed with WeKnora process privileges

Fixed in

apply WeKnora patch — check upstream

Mitigation

Update WeKnora to patched version; restrict external MCP server configuration to trusted administrators; apply input validation on all MCP server command parameters

Source: OX Security MCP STDIO Advisory ADVISORY-MCP-STDIO-2026-001 (2026-04-15)

@akoskm/create-mcp-server-stdio (npm scaffold)

Command injection vulnerability in the @akoskm/create-mcp-server-stdio npm scaffold — part of the systemic OX Security STDIO design flaw; the scaffold generates MCP server boilerplate code that passes user-supplied arguments directly to shell without sanitization, propagating the vulnerability to all projects created with the template

Fixed in

use patched scaffold version — regenerate or patch existing servers created with vulnerable template

Mitigation

Stop using @akoskm/create-mcp-server-stdio until patched; audit all MCP servers created with this scaffold for command injection patterns; apply CWE-78 mitigations (input validation, command allowlisting) to generated server code

Source: OX Security MCP STDIO Advisory ADVISORY-MCP-STDIO-2026-001 (2026-04-15)

Microsoft AI Agent Frameworks (in-memory vector store + ExecuteCode/DownloadFileAsync tools)

Remote code execution vulnerability in Microsoft AI agent frameworks that expose both ExecuteCode and DownloadFileAsync tools — attacker chains these two tools to (1) create a malicious script in the agent sandbox, then (2) escape by downloading it to a dangerous host location (e.g. Windows Startup folder) for persistent execution; sandbox escape is achievable via legitimate tool-call chaining without any binary exploit

Fixed in

apply Microsoft patch; remove DownloadFileAsync or restrict its permitted download paths; update AI agent framework to latest version

Mitigation

Patch Microsoft AI agent framework to latest version; restrict DownloadFileAsync to safe target directories only; audit agent tool combinations for dangerous chaining potential (ExecuteCode + any write-to-startup-path tool); apply principle of least privilege on agent tool access; require human approval for file write + execute sequences

Source: Microsoft Security Blog (2026-05-07)

RMCP (Rust SDK for Model Context Protocol)

DNS rebinding vulnerability in RMCP's Streamable HTTP server transport — the server did not validate the incoming Host header, allowing a malicious public website via DNS rebinding to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. Attacker can make any tool call as if they were a locally-running MCP-connected AI agent.

Fixed in

1.4.0

Mitigation

Update rmcp crate to >= 1.4.0; validate Host header on all incoming Streamable HTTP server requests; bind MCP servers to 127.0.0.1 only when network access is not required

Source: Tenable / NVD (2026-05-14)

MCP Java SDK (official Java SDK for Model Context Protocol)

DNS rebinding vulnerability in the MCP Java SDK — allows an attacker to access a locally or network-private Java SDK MCP server via the victim's browser. The attack enables an attacker to make any tool call to the server as if they were a locally-running MCP-connected AI agent.

Fixed in

1.0.0

Mitigation

Update MCP Java SDK to >= 1.0.0 (GHSA-8jxr-pr72-r468); bind MCP servers to localhost only; validate Host header on all incoming requests

Source: Tenable (2026-04-07)

mcp-framework (npm)

Denial-of-service vulnerability in mcp-framework HTTP transport — the readRequestBody() function concatenates incoming POST body chunks without enforcing the configured maxMessageSize limit, allowing a remote unauthenticated attacker to crash any mcp-framework HTTP server by sending a single oversized request to the /mcp endpoint, exhausting server memory.

Fixed in

0.2.22

Mitigation

Update mcp-framework to >= 0.2.22; as interim measure, deploy reverse proxy (nginx/HAProxy) with request body size limits; restrict /mcp endpoint to trusted network sources; monitor for oversized POST requests

Source: SentinelOne (2026-04-16)

Claude Code

File-write sandbox bypass in Claude Code — piped sed and echo commands escaped the project sandbox because command chaining was not validated against the file-write restriction rules. Attackers could use piped commands to write arbitrary files outside the permitted project boundary.

Fixed in

2.0.55

Mitigation

Update Claude Code to >= 2.0.55; in multi-agent environments validate command chaining patterns; treat piped shell commands as potentially sandbox-escaping

Source: VentureBeat / BeyondTrust security research (2026-04-30)

Claude Code

Permission mode bypass in Claude Code — Claude Code resolved permission modes from .claude/settings.json before showing the workspace trust dialog. A malicious repository could set permissions.defaultMode to 'bypassPermissions', causing the trust dialog to never appear and auto-approving all tool calls from the malicious repository.

Fixed in

2.1.53

Mitigation

Update Claude Code to >= 2.1.53; always review .claude/settings.json for suspicious permission overrides before accepting workspace trust; never run claude in untrusted repositories

Source: VentureBeat / Adversa research (2026-04-30)

Claude Code

Deny-rule enforcement bypass via subcommand chain length — Claude Code silently dropped its configured deny rules once a command exceeded 50 subcommands. Attackers could craft commands with 50+ chained subcommands to bypass any configured allow/deny rules, including security-critical restrictions.

Fixed in

2.1.90

Mitigation

Update Claude Code to >= 2.1.90; audit any workflows with unusually long command chains; do not rely solely on deny-list rules without defense-in-depth controls

Source: Adversa AI / VentureBeat (2026-05-01)

Splunk MCP Server app (below 1.0.3)

Session and authorization tokens written to log files in clear text in Splunk MCP Server app versions below 1.0.3 — a user with access to the Splunk _internal index or the mcp_tool_admin capability can read authentication tokens in plain text, enabling session hijacking, privilege escalation, or unauthorized access to protected Splunk resources

Fixed in

1.0.3

Mitigation

Update Splunk MCP Server app to >= 1.0.3; restrict _internal index access to administrator roles only; rotate any tokens that may have been exposed; audit mcp_tool_admin capability assignments

Source: Splunk Advisory SVD-2026-0407 / SentinelOne / NVD (2026-04-15)

MS-Agent v1.5.2 (ModelScope, Alibaba)

Shell command injection in the MS-Agent Shell tool — six validation layers exist but all are bypassable via regex blacklist evasion; attacker injects crafted content into any data source consumed by the agent (prompts, documents, logs, research inputs) to execute arbitrary OS commands; no direct shell access or operator misuse required. Enables reading secrets (API keys, tokens, config files), dropping payloads, modifying workspace state, establishing persistence, and pivoting to adjacent services.

Fixed in

check upstream MS-Agent releases post-1.5.2

Mitigation

Update MS-Agent beyond v1.5.2; replace regex-based command blacklisting with a strict allowlist of permitted operations; never pass untrusted external content (documents, web pages, user input) directly to agent shell tools without sanitization; isolate MS-Agent execution in sandboxes

Source: SecurityWeek / Itamar Yochpaz (Medium) / CyberSecurityNews (2026-02)

Azure MCP Server (@azure-devops/mcp npm — Microsoft Azure DevOps integration)

Information disclosure via missing authentication in the Azure MCP Server — the server exposes tools for interacting with Azure DevOps (work items, repos, pipelines, pull requests) without proper authentication, allowing unauthenticated network-accessible attackers to read sensitive data including configuration details, API keys, authentication tokens, and project data. CVSS vector: AV:N/AC:L/PR:N/UI:N (network-reachable, no credentials required, no user interaction needed). The MCP SDK itself does not include built-in authentication — the implementation flaw places responsibility on each server.

Fixed in

no patch confirmed at time of research — Microsoft has published mitigation guidance; monitor Microsoft Security Response Center for updates

Mitigation

Do not expose Azure DevOps MCP server to untrusted networks; require authentication at the network perimeter (reverse proxy with auth); restrict access to trusted agent identities only; audit all Azure DevOps data accessible via the MCP server; monitor Microsoft MSRC for patch release

Source: Microsoft disclosure / WindowsNews.ai / Dev Community (2026-04-03)

OpenClaw (OpenShell managed sandbox backend)

TOCTOU race condition in the OpenShell managed sandbox backend — attacker redirects writes outside the intended sandbox boundary; can be used to modify configuration files, plant backdoors, and establish persistence on the host system. Most severe link in the Claw Chain exploit chain.

Fixed in

OpenClaw 2026.4.22

Mitigation

Update OpenClaw to >= 2026.4.22 immediately; apply OS-level file integrity monitoring on OpenClaw configuration directories; restrict OpenClaw sandbox backend write permissions at the OS level as defense-in-depth

Source: Cyera Research / The Hacker News (2026-05)

OpenClaw (OpenShell managed sandbox backend)

TOCTOU race condition enabling file reads outside the sandbox intended boundaries — attacker can exfiltrate sensitive system files, credentials, and internal artifacts by exploiting the race window during sandbox file access validation; first step in the Claw Chain attack: attacker uses this to expose credentials before chaining to CVE-2026-44118 for privilege escalation

Fixed in

OpenClaw 2026.4.22

Mitigation

Update OpenClaw to >= 2026.4.22; see CVE-2026-44112 for chain context

Source: Cyera Research / The Hacker News (2026-05)

OpenClaw (shell allowlist validation)

Incomplete list of disallowed inputs in the OpenClaw shell allowlist validation logic — attacker bypasses the allowlist to execute commands or access files that should be blocked; used as a stepping stone in the Claw Chain to expand the initial sandbox compromise

Fixed in

OpenClaw 2026.4.22

Mitigation

Update OpenClaw to >= 2026.4.22; see CVE-2026-44112 for chain context

Source: Cyera Research / The Hacker News (2026-05)

OpenClaw (privilege model)

Privilege escalation to owner-level control in OpenClaw — exploited in step 3 of the Claw Chain (after credential exposure via CVE-2026-44113 + CVE-2026-44115), allowing an attacker with initial plugin/prompt access to obtain full owner-level permissions on the OpenClaw instance; enables unrestricted configuration modification and backdoor installation in the final step (CVE-2026-44112)

Fixed in

OpenClaw 2026.4.22

Mitigation

Update OpenClaw to >= 2026.4.22; apply principle of least privilege on OpenClaw instances; do not expose OpenClaw admin interfaces to untrusted networks

Source: Cyera Research / Rescana / The Hacker News (2026-05)

Claude Code CLI and Claude Agent SDK

OS command injection via TERMINAL environment variable manipulation — Claude Code constructs a shell command using the TERMINAL variable with shell=true without sanitizing shell metacharacters; a local attacker or prompt-injection payload that controls the TERMINAL environment variable can execute arbitrary commands with Claude Code process privileges; first link in a 3-CVE chain: CVE-2026-35020 (TERMINAL injection) → CVE-2026-35021 (path injection) → CVE-2026-35022 (auth helper exfil)

Fixed in

Claude Code 2.1.92 / Claude Agent SDK 0.1.56

Mitigation

Update Claude Code to >= 2.1.92; do not allow untrusted environments to set the TERMINAL variable; run Claude Code in isolated environments with controlled env vars

Source: SentinelOne (2026-04-10); Phoenix Security (2026-04-03)

Claude Code CLI and Claude Agent SDK

OS command injection in authentication helper execution — helper config values (apiKeyHelper, awsAuthRefresh, awsCredentialExport, gcpAuthRefresh) are passed to shell with shell=true without input validation; attackers who influence these settings (e.g. via CVE-2026-35020 writing malicious .claude/settings.json) can inject shell metacharacters to execute arbitrary commands and exfiltrate credentials; confirmed via four escalating PoC variants including multi-line file exfiltration of Claude Code's own MEMORY.md conversation history over HTTP

Fixed in

Claude Code 2.1.92 / Claude Agent SDK 0.1.56

Mitigation

Update Claude Code to >= 2.1.92; sanitize all auth helper config values before shell execution; never allow untrusted content to set auth helper parameters; rotate any credentials that may have been exposed

Source: SentinelOne (2026-04-10); GitHub Advisory GHSA-479q-mw77-pmr5; Phoenix Security (2026-04-03)

claude-code-action (Anthropic GitHub Action for CI/CD)

Indirect prompt injection via GitHub issue/PR content enabling permission bypass and CI/CD secret exfiltration — the action's checkWritePermissions function trusted any GitHub App actor whose token name ended in [bot], allowing any self-registered GitHub App to bypass write-permission checks and inject prompt payloads via issue bodies; injected prompts trick Claude Code into reading /proc/self/environ (exposing ANTHROPIC_API_KEY, OIDC tokens, and all workflow secrets) then writing contents to a GitHub issue comment; attacker who captures the OIDC token can exchange it for a GitHub App installation token with full repository write access; because Anthropic's own claude-code-action repository used the same vulnerable workflow, a successful attack could have propagated malicious code to every downstream consumer

Fixed in

claude-code-action v1.0.94; Claude Code 2.1.128 (blocks /proc/self/environ access)

Mitigation

Update claude-code-action to >= v1.0.94; update Claude Code to >= 2.1.128; audit GitHub Actions workflows for indirect prompt injection via issue/PR bodies; restrict CI/CD secrets to necessary workflows only; use OIDC token scoping; prefer workflow_run trigger over pull_request_target

Source: Flatt Security / RyotaK (2026-06-01); Microsoft Security Blog (2026-06-05); THN (2026-06-05)

Cursor (agent terminal sandbox)

DuneSlide #1 — working-directory restriction bypass: the optional working_directory parameter on Cursor's run_terminal_cmd tool lets an AI agent write and run commands outside the intended workspace boundary, and overwriting the cursorsandbox binary turns sandboxed commands into unsandboxed OS-level RCE via zero-click prompt injection

Fixed in

Cursor Desktop 3.0 (working-directory fix shipped 2026-04-02)

Mitigation

Update Cursor to >= 3.0; audit agent terminal sessions for out-of-workspace command execution

Source: Cato AI Labs DuneSlide (2026-07-01); GitHub Security Advisory GHSA-8pcm-8jpx-hv8r; BitNinja (2026-06-26); THN (2026-07-02)

Cursor (agent terminal sandbox)

DuneSlide #2 — file-write escape via insecure symlink-resolution fallback: when the safety check on path canonicalization fails, Cursor trusts the shortcut's path, letting the agent write files (e.g. overwrite the sandbox binary) outside the project boundary. Also the Cursor instance of the GhostApproval symlink approval-box class.

Fixed in

Cursor Desktop 3.0 (link-target fix shipped 2026-06-01/05)

Mitigation

Update Cursor to >= 3.0; do not accept agent file-write approvals for symlinked paths

Source: Cato AI Labs DuneSlide (2026-07-01); GitHub Security Advisory GHSA-8pcm-8jpx-hv8r; Wiz GhostApproval (2026-07-08); THN (2026-07-02)

Cursor (workspace .claude/.cursor hook config)

Workspace-controlled hook configuration file turns into unsandboxed command execution: a repo ships a hook config that the editor trusts and runs outside the agent sandbox on next launch, part of a broader 'configuration-based sandbox escape' pattern (files the agent writes inside its sandbox get executed by host tooling later, without re-checking trust)

Fixed in

Cursor 3.0.0

Mitigation

Update Cursor to >= 3.0.0; treat repo-provided hook/config files as untrusted until reviewed; do not let host tooling (Python extension, git hooks) auto-run files an agent wrote inside its own sandbox

Source: Pillar Security - Week of Sandbox Escapes (2026-07); BleepingComputer (2026-07)

Amazon Q Developer (VS Code extension / language server)

GhostApproval — symlink-based approval-box spoofing: a booby-trapped repository ships an innocent-looking file (e.g. project_settings.json) that is actually a symlink to a sensitive location (e.g. ~/.ssh/authorized_keys). When the developer asks the agent to set up the environment, it follows the link and writes attacker-supplied content (such as a public SSH key granting persistent passwordless access) outside the workspace, while the confirmation dialog shows a benign in-project path

Fixed in

Amazon Q language server 1.69.0 (2026-05-27)

Mitigation

Update Amazon Q language server to >= 1.69.0; never accept agent file-write approvals for symlinked paths; audit cloned repos for symlinks pointing outside the project before running setup

Source: Wiz GhostApproval (2026-07-08); AWS security bulletin; THN (2026-07-08)

Amazon Q Developer

Poisoned repository auto-loads a workspace config file and runs commands to steal a developer's AWS credentials once the workspace is trusted

Fixed in

Amazon Q language server 1.69.0 (2026-05-27)

Mitigation

Update to >= 1.69.0; do not auto-trust cloned workspaces; scope AWS credentials to least privilege and rotate if a poisoned repo was opened

Source: Wiz GhostApproval (2026-07-08); AWS security bulletin

FastMCP (OpenAPIProvider)

SSRF and path traversal via unencoded URL templates in OpenAPIProvider tool generation

Fixed in

See GHSA-vv7q-7jx5-f767 for patched version

Mitigation

Update FastMCP to the patched release; sanitize/encode URL template parameters before use

Source: GitHub Advisory GHSA-vv7q-7jx5-f767

LibreChat (MCP access control)

MCP access-control and environment-variable injection vulnerabilities in LibreChat's MCP integration

Fixed in

See vendor advisory for patched version

Mitigation

Update LibreChat to the patched release; audit MCP server configuration for injectable environment variables

Source: Threat-Modeling.com (2026-06-02)

@modelcontextprotocol/sdk (TypeScript)

ReDoS (regular expression denial of service) via resource template arrays

Fixed in

See GHSA-8r9q-7v3j-jr4g for patched version

Mitigation

Update @modelcontextprotocol/sdk to the patched release; validate/limit resource template array sizes

Source: GitHub Advisory GHSA-8r9q-7v3j-jr4g

Claude Code (WebFetch tool, pre-approved huggingface.co hostname)

huggingface.co was allowlisted as a bare hostname for WebFetch, so every path on that domain, including attacker-created model repositories, was fetched with no permission prompt. Novee turned Hugging Face's public download counter into an exfiltration oracle: 64 attacker-created repos, one per possible character, and the counter that increments tells the attacker which character came next. An API key leaves one character per request, entirely over a pre-trusted domain.

Fixed in

Claude Code 2.1.163

Mitigation

Upgrade to >= 2.1.163. Independently of the patch, audit your own WebFetch and permission allowlists for bare hostnames: any domain that lets an attacker create content and read back a public counter is an exfiltration channel, not just a fetch target. Prefer path-scoped entries over bare hostnames.

Source: Novee Security (Elad Meged) at Black Hat USA 2026, 2026-08-05; CSA research note (2026-08-07); The Hacker News (2026-08-07)

Google Gemini CLI + run-gemini-cli GitHub Action (container launcher)

OS command injection in the container launcher reached through a crafted .gemini/.env file. In headless CI the workspace is trusted automatically, so a .env shipped in an untrusted pull request is loaded as legitimate configuration and executes OS commands on the CI host BEFORE the sandbox initialises. A chained flaw let the agent read a sibling process's unredacted environment via /proc/[PID]/environ and push a backdoored commit through a dispatched second workflow with write access.

Fixed in

Gemini CLI 0.39.1 (or 0.40.0-preview.3); run-gemini-cli 0.1.22

Mitigation

Upgrade both the CLI and the Action, because patching one leaves the path open. Never let an agent run in headless CI with automatic workspace trust on untrusted pull requests. Enforce tool allowlists at execution time, not only at registration: this bug existed because registration checked the allowlist and execution never did.

Source: Novee Security at Black Hat USA 2026 (2026-08-05); CSA research note (2026-08-08); GHSA-wpqr-6v78-jr5g

MCP Ruby SDK (mcp gem, StreamableHTTPTransport + legacy SSE transport)

Session IDs are not bound to a session owner. An attacker holding a stolen session ID sends tools/call requests through /messages/{session-id} that execute in the victim's session, with responses delivered to the legitimate user's SSE stream. Silent by design: the victim's session performs attacker actions with no visible signal.

Fixed in

mcp gem 0.23.0

Mitigation

Upgrade the mcp gem to >= 0.23.0. Until then, require an authentication token on every request and reject any request whose session ID does not match the authenticated principal.

Source: MCP Ruby SDK security advisories (2026-07-08 published, NVD 2026-07-29); Tenable; Rapid7; GitLab advisory database

MCP Ruby SDK (mcp gem, StreamableHTTPTransport)

Unbounded JSON-RPC request body, read BEFORE authentication checks run. The advisory documents a single 512 MB request driving process memory from 44 MB to 1.66 GB. Unauthenticated attackers can exhaust host memory.

Fixed in

mcp gem 0.23.0

Mitigation

Upgrade to >= 0.23.0. Put a reverse proxy in front that caps request body size, and run MCP hosts under a memory-limited cgroup or container so exhaustion kills the container rather than the host.

Source: MCP Ruby SDK security advisories (2026-07-08); NVD (2026-07-29)

MCP Ruby SDK (mcp gem, StreamableHTTPTransport)

The Rack-mountable Streamable HTTP transport processes every JSON-RPC request without inspecting the HTTP Host or Origin header. No AllowedHosts, no AllowedOrigins, no DNS-rebinding guard. A malicious web page rebinds its own hostname to 127.0.0.1, then drives the victim's local MCP server cross-origin to enumerate tools, invoke them, and read the output back.

Fixed in

mcp gem 0.23.0

Mitigation

Upgrade to >= 0.23.0. Bind to 127.0.0.1 explicitly, or front the server with a reverse proxy that validates Host. Requiring a token per request also works, because a browser cannot read a token cross-origin.

Source: SentinelOne (2026-07-30); GitLab advisory database; NVD (2026-07-29)

MCP Ruby SDK (mcp gem, StdioTransport + Client::Stdio)

Both stdio transports call IO#gets with no byte limit. A peer that sends data without a terminating newline forces the process to accumulate bytes until the host runs out of memory and the process is OOM-killed.

Fixed in

mcp gem 0.23.0 (adds a max_line_bytes parameter, default 4 MiB)

Mitigation

Upgrade to >= 0.23.0. Restrict which local executables can be launched as MCP stdio peers, and cap memory per host process.

Source: SentinelOne (2026-07-30); offseq radar; NVD (2026-07-29); GHSA-7683-3w9x-ch42

MCP Ruby SDK (mcp gem, StreamableHTTPTransport)

Sessions never expire by default, so repeated initialize requests retain unbounded ServerSession objects until process memory is exhausted.

Fixed in

mcp gem 0.23.0

Mitigation

Upgrade to >= 0.23.0 and configure session expiry explicitly.

Source: Tenable (2026-07-30); NVD (2026-07-29)

Jane-xiaoer/skill-vision-control 1.3.0 (config.ts getSkillVersionsDir)

Path traversal via the skillName argument, escaping the intended skill versions directory

Fixed in

unpatched as of 2026-08-17, maintainer has not responded to disclosure

Mitigation

Do not install; if already installed, treat any caller-supplied skill name as hostile and validate against a fixed allowlist

Source: VulDB via NVD (2026-08-09); 0dayNews wave summary

aktsmm/skill-ninja-mcp-server 0.1.0 (installer.ts uninstallSkill)

Path traversal via workspacePath in the functions that install, update and remove skills and modify AGENTS.md. A server whose whole job is writing agent instruction files, with an unvalidated path argument.

Fixed in

0.1.1

Mitigation

Upgrade to 0.1.1. Also review AGENTS.md history in any repo this server touched, since the same argument that traverses paths writes agent instructions.

Source: VulDB via NVD (2026-08-09); Breachroad analysis

abracadabra50/claude-sesh (enricher.ts enrichSession)

Path traversal in session enrichment, reachable through the session data the tool reads

Fixed in

unconfirmed, check upstream

Mitigation

Avoid until patched; a session-reading MCP server runs with access to your Claude Code transcripts

Source: VulDB via NVD (2026-08-09)

andreahaku/codex_mcp (codex-process-simple.ts, 'ask' MCP tool)

Command injection through the ask tool's argument handling

Fixed in

unconfirmed, check upstream

Mitigation

Avoid until patched

Source: VulDB via NVD (2026-08-09)

NightTrek/Ollama-mcp (index.ts)

Command injection in the Ollama MCP bridge

Fixed in

unconfirmed, check upstream

Mitigation

Avoid until patched; prefer the official Ollama integration path

Source: VulDB via NVD (2026-08-09)

Pimzino/spec-workflow-mcp 2.2.0-2.2.6 (approvals.ts ApprovalStorage.createApproval)

Path traversal via the categoryName argument when writing approval records

Fixed in

2.2.7

Mitigation

Upgrade to >= 2.2.7

Source: VulDB via NVD (2026-08-09), patch commit 9c7a7839

adenot/mcp-google-search <= 0.3.1 (read_webpage tool)

SSRF via the url argument in read_webpage: a controlled URL directs the request at anything the MCP host can reach

Fixed in

patch commit f071d491, no tagged release named in the advisory; verify your installed copy contains it

Mitigation

The fix is the right template for any URL-taking tool: restrict protocols to HTTP/HTTPS, resolve DNS, block private, loopback, link-local and multicast v4/v6 ranges, and disable automatic redirects

Source: VulDB via NVD (2026-08-09)

aliyun/alibabacloud-dataworks-mcp-server 1.0.0-1.0.43 (ReadResourceRequestSchema)

SSRF via request.params.uri, classified as remotely exploitable, unusual in this wave, where nearly everything else needs local access

Fixed in

unpatched as of 2026-08-17, project did not respond to the earlier report

Mitigation

Disable the tool and restrict egress from the MCP host. SSRF from an agent tool reaches localhost panels, private-network services and cloud metadata endpoints that trust the host's address.

Source: VulDB via NVD (2026-08-09)

KS-GEN-AI/jira-mcp-server 0.2.0 (add_attachment_from_public_url, axios.get)

SSRF via the imageUrl argument

Fixed in

unpatched as of 2026-08-17, project informed via issue report and no response

Mitigation

Disable the attachment-from-URL tool; restrict MCP host egress

Source: VulDB via NVD (2026-08-09); Tenable

AstrBot (MCP Test Endpoint)

SSRF via ToolsRoute.test_mcp_connection: the mcp_server_config.url parameter is not validated, letting a remote attacker make AstrBot issue HTTP requests to internal or arbitrary external targets

Fixed in

unconfirmed — check upstream release notes for the first release after 4.25.2; no patched version explicitly stated in public advisories as of this update

Mitigation

Do not expose the MCP Test Endpoint to untrusted networks; restrict mcp_server_config.url to an allowlist of internal hosts pending a confirmed patched version

Source: cvefeed.io; secnews.gr (disclosed 2026-07-12)

SiYuan (asset.upload MCP tool)

Path traversal in the asset.upload MCP tool — accepts arbitrary absolute file paths without workspace boundary validation; a prompt-injected instruction can direct the built-in AI agent to copy sensitive files such as SSH keys or credentials from outside the workspace into the asset directory

Fixed in

3.8.1

Mitigation

Upgrade SiYuan to >= 3.8.1; do not grant the AI agent access to untrusted prompts while asset.upload is reachable on an older version

Source: GHSA-p23f-cm6q-2qp8 / NVD (2026-08-28)

MCP PHP SDK (Composer package mcp/sdk, HttpTransport)

Unbounded in-memory buffer growth in the SSE-consuming HttpTransport — incoming Server-Sent Events chunks are appended to a buffer with no upper bound and flushed only on the event delimiter, so a malicious, compromised, or man-in-the-middle MCP server that withholds the delimiter exhausts client process memory and causes denial of service

Fixed in

0.7.1

Mitigation

Upgrade mcp/sdk to >= 0.7.1; do not point HttpTransport at untrusted or unauthenticated MCP server endpoints

Source: GHSA-7m52-jw36-44r3 / NVD (2026-08-25)