Unexpected Code Execution

Penpot's MCP server component exposed an unauthenticated HTTP endpoint bound to all network interfaces that allowed arbitrary JavaScript execution on the host. Any network-adjacent attacker could remotely execute code without credentials, making this a critical, easily exploitable vulnerability in an agent-tooling component.

Updated Jul 15, 2026 · CVSS 8.8

Cursor's browser-enabled Cloud Agent exposed a local agent control endpoint without authentication, allowing malicious web content encountered by the agent's browsing capability to reach it from inside the sandbox. This let attacker-controlled pages trigger code execution within the agent's session and steal repository files, environment variables, credentials, and GitHub App tokens. The vendor fixed the issue by requiring authentication on the endpoint.

Updated Jul 15, 2026

The mastergo-magic-mcp MCP server (versions up to 0.2.0) contains a server-side request forgery vulnerability in its getComponentLink tool, caused by insufficient validation of the url argument passed to a z.string schema check. A remote attacker can supply a crafted URL to make the MCP server issue requests to arbitrary internal or external endpoints. A public exploit exists and the vendor has not yet responded to the disclosure.

Updated Jul 15, 2026 · CVSS 6.3

The AWS HealthLake MCP Server fails to validate that pagination URLs returned via the next_token parameter point back to the legitimate HealthLake endpoint, enabling an authenticated user to redirect the server's outbound requests to an attacker-controlled endpoint. This can leak AWS temporary security credentials used by the MCP server, giving an attacker a foothold to access AWS resources tied to those credentials. Fixed in version 0.0.14.

Updated Jul 15, 2026 · CVSS 7.3

This is an academic benchmark paper (NetInjectBench), not an active exploit, demonstrating that LLM agents used for network operations can be manipulated via indirect prompt injection embedded in tickets, alerts, logs, and ChatOps messages to trigger unsafe tool actions. The researchers show naive agents execute unsafe actions 82.5% of the time under attack, but a metadata-aware execution-time policy gate can reduce this to near-zero while preserving usefulness. The severity is rated medium because this is defensive research quantifying and mitigating a known risk class rather than a disclosed vulnerability in a specific deployed product.

Updated Jul 14, 2026

AstrBot's dashboard MCP connection test feature allows an attacker to supply an arbitrary URL that the server will fetch, resulting in server-side request forgery (SSRF). This could let an attacker probe internal networks, hit cloud metadata endpoints, or pivot against internal services from the AstrBot server. Exploit details are public and the vendor has not responded, increasing real-world risk.

Updated Jul 12, 2026 · CVSS 6.3

PraisonAI's CodeAgent executes LLM-generated Python code with no AST validation, import restrictions, or sandboxing, allowing an attacker who can influence the LLM's output via prompt injection to achieve full remote code execution on the host. This gives attackers a direct path to exfiltrate all environment secrets and compromise the underlying system, making it a maximum-severity flaw.

Updated Jul 11, 2026 · CVSS 10

LangChain4j's MariaDB and pgvector embedding store integrations build SQL queries by unsafely concatenating metadata filter keys (and MariaDB string values) into query strings, allowing an attacker who controls filter input to inject SQL. This can lead to blind data exfiltration, denial of service, and mass deletion of vector store data via crafted EmbeddingSearchRequest filters.

Updated Jul 11, 2026 · CVSS 7.6

MCP Server Kubernetes before version 3.9.0 has a flaw that lets attackers smuggle malicious flags (like --server) into kubectl commands by disguising them as resource names with leading dashes, bypassing the tool's dangerous-flag safety check. This allows redirecting kubectl operations to an attacker-controlled API server, leaking the operator's bearer token and enabling full Kubernetes cluster takeover.

Updated Jul 11, 2026 · CVSS 9.8

Langroid versions before 0.65.2 contain a critical flaw where LLM-generated tool messages evaluated via Python's eval() with a supposedly empty 'locals' dict can still access all built-in functions, since '__builtins__' is implicitly injected into globals. This allows any attacker capable of influencing LLM output (e.g., via prompt injection) to achieve full unauthenticated remote code execution on the host running the agent.

Updated Jul 10, 2026 · CVSS 10

Langroid's file read/write tools fail to properly restrict operations to a configured working directory, allowing an LLM agent or user-controlled tool call to escape that directory using path traversal sequences. This lets an attacker read arbitrary files (e.g., secrets, credentials) or write files anywhere the process has permissions, despite the framework appearing to sandbox file access to a project workspace. The issue is patched in version 0.64.0.

Updated Jul 10, 2026 · CVSS 7.1

Langroid's SQLChatAgent uses an incomplete regex denylist to block dangerous SQL functions before executing LLM-generated queries against a live database. Because the denylist omits PostgreSQL file-reading functions (pg_read_file, pg_stat_file, etc.) and certain SQL Server/SQLite file-attach primitives, an attacker who can influence the generated SQL—directly or via prompt injection in ingested data—can craft ordinary SELECT statements that read arbitrary files from the database host, bypassing the agent's strict default safety configuration entirely.

Updated Jul 10, 2026

Langroid's Neo4jChatAgent forwards LLM-generated Cypher queries directly to the Neo4j driver without validation, statement allowlisting, or an opt-out mechanism. An attacker who can influence the prompt—either directly or via indirect content ingested through RAG—can manipulate the LLM into generating destructive or data-exfiltrating Cypher queries, and potentially achieve OS command execution if APOC or dbms.security procedures are enabled on the server. This mirrors a previously patched SQLChatAgent vulnerability (CVE-2026-25879) whose fix was never extended to the Neo4j module.

Updated Jul 10, 2026

Researchers demonstrate that LLM agents frequently hallucinate plausible-sounding resource names (repos, skills, packages) when performing tasks like cloning or installation, and these hallucinations are predictable and transferable across models. Attackers can preemptively register these hallucinated resource names to host malicious payloads, causing agents that autonomously fetch and execute them to become compromised at scale, effectively forming a botnet without needing any direct prompt injection channel.

Updated Jul 9, 2026

This is a defensive research paper (not an active exploit) analyzing taint-style vulnerabilities in MCP server implementations, where untrusted input flows into dangerous sinks like command execution or file access. The authors propose SPELLSMITH, a mitigation that uses enhanced tool descriptions and LLM self-reflection to reduce exploitation risk without requiring code-level fixes. Severity is medium since it documents a real and underexplored class of vulnerabilities in deployed MCP servers, but the source itself is a proactive defense proposal rather than a disclosed active attack.

Updated Jul 9, 2026

A vulnerability in n8n's AI Agents feature allowed a low-privilege user with only 'use' access to a shared credential to bypass the configured Allowed HTTP Request Domains restriction by pointing an MCP tool at an arbitrary attacker-controlled URL. This let the attacker exfiltrate the credential's secret value to an external server, effectively escalating from use-only access to full credential disclosure. The issue is fixed in n8n 2.27.4 and 2.28.1.

Updated Jul 9, 2026

Cline's local Hub dashboard server fails to validate the Origin header on its WebSocket /browser endpoint, allowing any malicious website visited by a user to connect and issue commands. When ROOM_SECRET is unset (the default for local binds), attackers can read workspace state, tamper with MCP and provider settings, and trigger arbitrary command execution if a model provider is configured. This is a critical, fully remotely exploitable vulnerability via drive-by browser interaction with no user awareness required.

Updated Jul 9, 2026 · CVSS 8.8

Composio SDK versions before 0.2.32-beta.283 fail to validate file paths in a file-upload tool, allowing an attacker who controls untrusted input (e.g., via prompt injection) to redirect the agent into reading and uploading sensitive local files such as SSH private keys to attacker-controlled storage. This is a realistic and impactful supply-chain/tool-layer vulnerability, not a speculative or low-severity issue.

Updated Jul 9, 2026 · CVSS 6.8

This is an academic survey (SoK) that reviews and categorizes 39 existing papers on execution-layer security for AI coding agents, rather than describing a novel exploit or active campaign. It highlights systemic weaknesses across the field—such as high denylist bypass rates, unaddressed TOCTOU races, and fragmented treatment of MCP threats—and references four previously disclosed, already-patched CVEs. Severity is low-to-medium as a direct threat signal since no new vulnerability or attack technique is disclosed; its value is as a roadmap of known/likely weak points defenders should prioritize.

Updated Jul 8, 2026

Researchers demonstrate a structural flaw in the Model Context Protocol: the metadata a human approves in a tool-installation dialog is not guaranteed to match the bytes actually sent to the model. Using invisible Unicode TAG-block characters embedded in tool descriptions, an attacker can smuggle hidden instructions that a human reviewer never sees but that reach the LLM verbatim on every turn, and this was confirmed across three independent MCP server implementations. This is a research proof-of-concept, not an observed active exploit, but it identifies a reproducible, protocol-level weakness rather than a one-off bug.

Updated Jul 8, 2026