Threat Library

PaperCut NG/MF is affected by an unsafe reflection vulnerability that allows attackers to manipulate system configuration parameters and execute arbitrary Java bytecode under the security context of the PaperCut server process. This flaw has been added to CISA's Known Exploited Vulnerabilities catalog and can be chained with CVE-2026-81578 to achieve full remote code execution, mirroring the exploitation pattern seen in prior PaperCut attacks used for ransomware and network intrusion.

This is a benign blog post from Simon Willison covering the announcement of 'wrapture', a Python monkeypatching/tracing library built by Graham Dumpleton. There is no security vulnerability, exploit, or attack technique described here; it is simply a developer tooling announcement that happens to mention the library was written with AI assistance.

MCPHub, a multi-tenant hub for orchestrating MCP servers, failed to enforce ownership checks on its tool-execution API even though it correctly scoped list and config views. Any authenticated non-admin user could invoke tools on MCP servers owned by other tenants, leading to cross-tenant compromise including arbitrary host file reads and SSRF using another user's connected credentials. The issue is fixed in version 1.0.30.

MCPHub, a centralized management hub for MCP servers, has an incomplete SSRF guard that fails to block IPv6 transition addresses like NAT64, 6to4, and Teredo. An attacker who can supply a URL for an MCP server connection can embed a private IPv4 address inside one of these IPv6 formats to bypass the filter and reach internal infrastructure. This is a classic SSRF filter evasion issue, patched in version 1.0.32.

MCPHub, a management hub for MCP servers, fails to restrict server configuration endpoints to admin users and does not sanitize the command/args used to spawn MCP server processes. Any authenticated non-admin user can register a malicious MCP server configuration that MCPHub immediately executes, resulting in full remote code execution as the host's OS user, often root. This is a critical, easily exploitable authorization flaw with a severe real-world impact.

MCPHub, a management hub for MCP servers, allows any authenticated non-admin user to register a malicious MCP server pointing at arbitrary internal or external URLs, causing the hub to make server-side requests without egress filtering. This enables both reflected SSRF (attacker sees response data via the OpenAPI proxy) and blind SSRF (via SSE/streamable-http transport), potentially exposing internal services, cloud metadata endpoints, and loopback/RFC1918 resources.

MCPHub, a management hub for multiple MCP servers, contains a flawed authorization check that lets a bearer key scoped to one specific MCP server gain access to every other server in the same group. Any credential holder with narrow, single-server authorization can silently pivot to unauthorized MCP servers, effectively breaking the tool/server isolation model the hub is meant to enforce. This was fixed in version 1.0.31.

MCPHub, a centralized hub for orchestrating multiple MCP servers, contained a broken access control flaw where any authenticated user could modify system-wide configuration via the PUT /api/system-config endpoint, since the handler never checked admin privileges. This allows a low-privileged user to reconfigure routing to MCP servers, potentially redirecting agent traffic, disabling security controls, or hijacking tool orchestration across the hub. The issue is fixed in version 1.0.29.

MCPHub, a hub for managing multiple MCP servers, fails to sanitize the manifest.json 'name' field when extracting uploaded MCPB (zip) files, allowing an attacker to use path traversal sequences to write files outside the intended extraction directory. The same unsanitized field is also used during cleanup, enabling arbitrary directory deletion. This lets a malicious MCP server package achieve file system compromise on the host running MCPHub, potentially leading to code execution or destructive data loss.

MCPHub prior to version 1.0.32 fails to enforce admin-only access on prompt and resource management endpoints, allowing any authenticated non-admin user to create, overwrite, or shadow globally-served prompt templates and resources. Because these tampered records are consulted before any connected MCP server for every session, the flaw enables stored prompt injection into other users' LLM sessions. The issue is patched in 1.0.32.

Eclipse Theia's AI Agent Mode file-editing tools fail to validate that model-supplied file paths stay within the workspace, allowing a malicious or manipulated model output to write or delete arbitrary files on the host. Since these tools execute without user confirmation, an attacker who can influence model output via indirect prompt injection can escalate to full code execution on the backend by overwriting files like shell startup scripts or SSH authorized_keys. This is a critical, high-impact vulnerability combining a classic path traversal flaw with the AI-specific attack surface of untrusted model-controlled tool arguments.

A person reportedly embedded hidden AI instructions inside a legal filing, attempting to manipulate any AI system that later reads and processes the document into ruling or advising in their favor. This is a classic indirect prompt injection attack applied to a real-world professional document workflow rather than a novel technical exploit. Severity is moderate since the report describes a single documented incident without technical detail on payload sophistication or actual impact on a legal outcome.

This is a defensive research paper, not an active exploit report. It describes 'Semantic Overlays,' a technique using trained adapters on a model's residual stream to help LLMs distinguish trusted instructions from untrusted content (e.g., tool output, user input), thereby mitigating prompt injection attacks. The underlying threat it addresses—LLMs losing track of span identity and being manipulated by text that mimics instructions—is a well-known, genuine issue, but the raw data itself presents a mitigation, not a novel attack.

This is a defensive research paper, not an active exploit or newly disclosed vulnerability. It proposes ROPE, a system that tracks the provenance of tool call parameters to block indirect prompt injection (IPI) attacks where malicious instructions embedded in tool-read content hijack an agent's tool calls. The underlying threat class (IPI leading to unauthorized state-changing tool calls) is real and well-known, but this document itself describes a mitigation with strong empirical results, not a new attack.

This is an academic research paper describing CAITLYN, a defensive middleware designed to detect and autonomously synthesize countermeasures against prompt injection attacks on LLM agents. It is not an active exploit or attack disclosure, but rather a proposed defense system; the paper also introduces a new benchmark ('Emerging') that reveals existing static defenses are vulnerable to novel injection techniques, which is a defensive-research finding rather than a new threat.

This is an academic benchmark paper (not an active exploit) demonstrating that existing prompt injection defenses, which perform reasonably in short-context settings, largely fail when injected instructions are embedded in long documents like resumes, code, or emails. The authors show even simple heuristic injection attacks bypass state-of-the-art defenses at high success rates in realistic long-context LLM application scenarios. Severity is moderate because it is a research finding highlighting a systemic weakness rather than a disclosed exploit against a specific product or live system.

The ash_ai library's MCP server implementation has a flawed origin validation check that can be bypassed using DNS rebinding, allowing a malicious website to issue cross-site requests to a user's locally running MCP server as that user's authenticated actor. Both values used in the trust decision (Host header and X-Forwarded-Proto header) are attacker-controlled from the browser, making the check ineffective by default. This affects versions 0.8.0 through before 1.0.0 and is fixed by defaulting to trusting only localhost origins.

The ash_ai library for the Elixir Ash framework evaluates user-influenced prompt content as live EEx templates, allowing an unauthenticated remote attacker to inject Elixir code that executes on the server before any LLM call is made. This is a classic code injection flaw exposed through an AI agent's prompt-construction pipeline, not a prompt injection against a model itself, but it is trivially reachable via any agent action that lets request data flow into a prompt template. Any deployment using ash_ai versions before 1.0.0 with dynamic prompt content is at critical risk of full server compromise.

Security researcher Olivier Laflamme disclosed two independent exploit chains achieving root remote code execution on the Unitree G1 EDU humanoid robot, tracked as CVE-2026-76639 and CVE-2026-76640. One chain requires only Bluetooth Low Energy proximity to compromise the robot's Locomotion PC, while the other exploits a network-adjacent path through the chat_go and bashrunner components, posing serious risks for research, industrial, and educational deployments of the robot.

Researchers identified 19 malicious Chrome and Edge extensions published over the past six months that steal cryptocurrency wallet secrets and drain funds. The extensions share common code and tradecraft, suggesting a coordinated campaign distributed through official browser extension stores. This poses a broad supply-chain risk to any user or organization installing these extensions.