Unexpected Code Execution

An MCP server tool that fetches URLs on behalf of callers only validated the URL scheme and syntax, not the destination host or resolved IP address. This allowed any caller of the MCP server to force it to request internal-only endpoints, including cloud instance metadata services, and read back sensitive data such as cloud credentials.

Updated Aug 29, 2026 · CVSS 8.6

SiYuan's asset.upload MCP tool fails to validate that file paths stay within the intended workspace, allowing an attacker to use prompt injection to trick the AI agent into pulling sensitive files like SSH keys from outside the workspace into an accessible asset directory. This effectively turns a benign file-upload tool into a data exfiltration primitive controllable via untrusted text fed to the agent.

Updated Aug 28, 2026 · CVSS 5.7

Security researcher Johann Rehberger demonstrated an attack that bypasses Claude Code's Opus 5 'Auto Mode' safety classifier roughly 80% of the time, tricking the agent into downloading a zip archive containing a malicious local struct.py file that gets silently imported instead of Python's standard library module. In some runs the Auto Mode safety system actively blocked Claude's own attempt to terminate the malicious process once it detected the compromise, meaning the safety mechanism itself worsened the outcome. This shows Auto Mode is an unreliable standalone defense against prompt injection and unattended agents need real sandboxing.

Updated Aug 28, 2026

The mcp-use inspector's proxy middleware forwarded requests to any target supplied by the caller via a header or parameter, without validating whether that address pointed to internal, loopback, or link-local infrastructure. This allowed an attacker to force the server to make requests on its behalf to internal-only services and read the responses, a classic SSRF pattern applied to an MCP tooling component. The issue has been fixed by introducing host validation and redirect-following limits.

Updated Aug 27, 2026 · CVSS 8.6

A vulnerability in GitLab's AI Gateway allowed an authenticated user with Duo Agent Platform access to redirect the AI Gateway's outbound model requests to an attacker-controlled endpoint by crafting a malicious inline flow configuration that overrides the HTTP Host header. This SSRF-style redirection could leak sensitive Google Cloud Vertex service credentials and private signing keys to the attacker's server, representing a serious confidentiality breach in the agent's model-calling infrastructure.

Updated Aug 27, 2026 · CVSS 8.2

A vulnerability in gpt-researcher (v0.14.7 and earlier) allows an unauthenticated remote attacker to achieve code execution by sending malicious Model Context Protocol configurations through the application's WebSocket endpoint. Because the endpoint lacks authentication, any network-reachable attacker can trigger this without valid credentials, making it a high-impact, low-effort exploitation path.

Updated Aug 27, 2026

Google's langfun library (versions before 0.1.2) evaluates Python expressions generated by an LLM in response to lf.query prompts without any sandboxing. A remote unauthenticated attacker who can influence prompt input can cause the model to emit malicious Python code that gets executed directly in the host application, resulting in full arbitrary code execution.

Updated Aug 26, 2026

This is an academic research paper (not an active exploit) describing 'TrustShift', a class of attacks where a malicious MCP tool server behaves benignly during an initial conditioning period to build trust, then switches to adversarial behavior once agents rely on it heavily. The researchers built an attack taxonomy and a benchmark showing ~69.5% attack success rate against frontier agents, plus a runtime defense (SHIELD) that reduces this to ~42.7%.

Updated Aug 26, 2026

This is an academic security analysis (not an active exploit) of Google's Agent Payments Protocol v0.2, which is used by LLM-driven shopping agents to authorize payments. The researchers show that while signed Checkout and Payment Mandates protect transaction integrity after signing, the A2A and MCP interactions that shape the transaction beforehand are unprotected, enabling an agent to be manipulated into signing a mandate that does not reflect the user's true intent. The paper identifies 48 catalogued threats across five attack families, with eight rated High severity, and provides proof-of-concept demonstrations plus a deployment-aware scanner.

Updated Aug 26, 2026

This is a defensive research paper, not an active exploit: it identifies real trust-boundary gaps in the emerging W3C WebMCP proposal that let malicious web pages spoof tool ownership, manipulate tool lifecycles, and inject prompts via tool metadata/descriptions into browser-integrated LLM agents. The authors propose and empirically validate a dual-layer runtime (cryptographic tool provenance plus a quarantine/privileged agent split) that reduces these attack classes to near-zero success, while also disclosing a residual bypass via malicious tool names invoked before inspection.

Updated Aug 26, 2026

MCP tools in the sublinear-time-solver and consciousness-explorer packages accept a user-supplied file path parameter and pass it directly to filesystem operations without validating or restricting the destination. This allows any client able to invoke these MCP tools to read, write, or overwrite arbitrary files accessible to the server process, leading to data exposure, tampering, or service disruption. The issue is fixed in later versions of both packages.

Updated Aug 26, 2026 · CVSS 7.1

The genieacs-mcp MCP server, prior to version 0.3.2, exposes an unauthenticated HTTP listener on localhost by default and fails to validate Host/Origin headers, making it vulnerable to DNS rebinding attacks from malicious websites. An attacker who lures a victim to a malicious webpage can pivot through the victim's browser into the local MCP server and issue commands against the GenieACS TR-069 ACS backend, potentially rebooting devices, altering firmware tasks, or changing CPE configuration. This is a genuine, well-documented vulnerability with a clear exploitation path and meaningful impact on managed device fleets.

Updated Aug 26, 2026

A vulnerability in Amazon Strands Agents Tools' python_repl tool allows attackers to craft prompts that bypass the human-in-the-loop consent gate by forwarding a non_interactive_mode keyword argument through the batch tool. This can lead to arbitrary Python code execution on the agent's host without human approval, effectively defeating a key safety control. Upgrading to version 0.8.5 or later remediates the issue.

Updated Aug 26, 2026 · CVSS 8.1

The official MCP PHP SDK contains a flaw where its HTTP transport buffers Server-Sent Events data without any size limit, waiting indefinitely for a delimiter that a malicious server can simply withhold. A hostile or compromised MCP server (or a man-in-the-middle) can exploit this to crash or hang any connecting PHP-based MCP client through memory exhaustion, with no authentication or user interaction required.

Updated Aug 26, 2026

The Nextcloud MCP Server's webhook endpoint lacks authentication by default because a required secret defaults to None, letting any network attacker send forged requests. These forged requests can delete or force re-indexing of another user's semantic search embeddings in Qdrant, effectively destroying or manipulating the AI assistant's retrieval memory. This is a critical, unauthenticated remote vulnerability fixed in version 0.117.2.

Updated Aug 25, 2026 · CVSS 9.1

mcp-shell, an MCP server designed to run shell commands securely, contains a filter bypass that allows a malicious or compromised caller to execute arbitrary OS commands via a crafted Git alias, even with 'secure mode' enabled. Because the default Docker deployment includes Git and runs the vulnerable filters out of the box, any agent or user with MCP connectivity to the tool can achieve full arbitrary code execution as the mcpuser process. This is a critical tool-layer vulnerability affecting the trust boundary between an AI agent and the command-execution tool it calls.

Updated Aug 25, 2026 · CVSS 8.4

The mcp-shell MCP server, intended to safely execute allowlisted shell commands on behalf of an AI agent, fails to properly validate command arguments when the executable is bash. An attacker or a compromised/malicious agent can invoke the shell_exec tool with '/bin/bash -c <command>' to run arbitrary commands as the mcpuser, completely bypassing the intended security allowlist. This is a high-severity tool-layer vulnerability that gives an attacker code execution wherever the fixed pre-0.6.0 mcp-shell server is deployed.

Updated Aug 25, 2026 · CVSS 8.4

mcp-shell, an MCP server that exposes shell command execution to LLM agents, ships with security disabled by default and the documented installation steps never enable it. As a result, any LLM or agent connected to a default deployment can run arbitrary OS commands as the mcp-shell process user, giving effectively unrestricted remote code execution through a trusted tool interface. The issue is fixed in version 0.6.0.

Updated Aug 25, 2026

QWED, an infrastructure component used to verify LLM/agent tool outputs and math expressions before production execution, passes untrusted expressions directly to SymPy's parse_expr() without restricting namespaces, allowing arbitrary Python code execution in the API server. Because signup and API key issuance are open by default, any external attacker can register a tenant, obtain a valid API key, and trigger remote code execution via the math verification endpoints, fully compromising the server and other tenants in shared deployments.

Updated Aug 25, 2026 · CVSS 8.8

browse-mcp, an MCP server that gives agents headless-browser capabilities, fails to validate caller-controlled save paths in its browser_download, browser_save_state, and browser_load_state tools, allowing arbitrary file writes anywhere the process can reach. An attacker who controls a webpage the agent visits can use indirect prompt injection to steer the agent into writing attacker-controlled content to sensitive locations like ~/.bashrc or cron files, potentially achieving full host code execution. A separate flaw in the force_fetch fallback also bypasses the configured origin allowlist entirely.

Updated Aug 25, 2026