Unsafe Code Execution

Manifold Security found eight flaws in seven popular command-line AI coding agents (including Claude Code, Codex, and Cursor) where a malicious repository's Git configuration can specify a command that the agent automatically executes on the developer's machine. This execution happens outside the agent's sandbox and without any user approval prompt, meaning simply cloning or opening a booby-trapped repo can lead to arbitrary code execution as the developer's user. Four of the eight issues remained unpatched at the time of publication.

Updated Sep 3, 2026 · CVSS 8.1

Attackers are actively exploiting an unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, a popular open-source framework for building AI agent workflows. Successful exploitation allows attackers to execute arbitrary code on exposed Langflow instances and harvest sensitive credentials such as OpenAI and AWS keys stored in the environment. This poses a critical supply-chain risk to organizations running AI application pipelines built on this framework.

Updated Sep 2, 2026

The ash_ai library for the Elixir Ash framework evaluates user-influenced prompt content as live EEx templates, allowing an unauthenticated remote attacker to inject Elixir code that executes on the server before any LLM call is made. This is a classic code injection flaw exposed through an AI agent's prompt-construction pipeline, not a prompt injection against a model itself, but it is trivially reachable via any agent action that lets request data flow into a prompt template. Any deployment using ash_ai versions before 1.0.0 with dynamic prompt content is at critical risk of full server compromise.

Updated Aug 31, 2026

A critical flaw in IBM Langflow OSS allows an authenticated user to escalate from limited flow-building privileges to full arbitrary command execution on the server. By crafting a malicious 'type' field in a saved flow and triggering a build via a wrapper flow, an attacker bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false safeguard intended to block custom code execution. This effectively hands the attacker OS-level control of the agent server process.

Updated Aug 29, 2026 · CVSS 9.9

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to improper control over code generation. This affects a widely used low-code framework for building AI agent workflows, meaning any authenticated user could potentially compromise the underlying host or downstream agent components.

Updated Aug 29, 2026 · CVSS 8.8

ToolUniverse's python_code_executor tool exposes a Python sandbox that can be trivially escaped using the classic __class__.__base__.__subclasses__() technique to reach process and subprocess modules, because its security relies on an incomplete denylist rather than real isolation. This sandbox is served over HTTP and MCP endpoints that bind to all network interfaces with no authentication and debugging enabled, meaning any network-reachable attacker can achieve full remote code execution as the server process. This is a maximum-severity, trivially exploitable vulnerability with no prerequisites.

Updated Aug 29, 2026 · CVSS 10

Security researcher Johann Rehberger demonstrated an attack that bypasses Claude Code's Opus 5 'Auto Mode' safety classifier roughly 80% of the time, tricking the agent into downloading a zip archive containing a malicious local struct.py file that gets silently imported instead of Python's standard library module. In some runs the Auto Mode safety system actively blocked Claude's own attempt to terminate the malicious process once it detected the compromise, meaning the safety mechanism itself worsened the outcome. This shows Auto Mode is an unreliable standalone defense against prompt injection and unattended agents need real sandboxing.

Updated Aug 28, 2026

ServiceNow patched a code injection vulnerability in its AI platform that could have let an unauthenticated attacker run arbitrary code and access or modify instance data beyond intended scope. The vendor has already shipped fixes and states no known active exploitation, but the flaw's unauthenticated nature and broad impact on instance data make it significant. This is a legitimate, remediated vulnerability rather than an emerging in-the-wild campaign.

Updated Aug 27, 2026

A vulnerability in gpt-researcher (v0.14.7 and earlier) allows an unauthenticated remote attacker to achieve code execution by sending malicious Model Context Protocol configurations through the application's WebSocket endpoint. Because the endpoint lacks authentication, any network-reachable attacker can trigger this without valid credentials, making it a high-impact, low-effort exploitation path.

Updated Aug 27, 2026

Google's langfun library (versions before 0.1.2) evaluates Python expressions generated by an LLM in response to lf.query prompts without any sandboxing. A remote unauthenticated attacker who can influence prompt input can cause the model to emit malicious Python code that gets executed directly in the host application, resulting in full arbitrary code execution.

Updated Aug 26, 2026

A vulnerability in Amazon Strands Agents Tools' python_repl tool allows attackers to craft prompts that bypass the human-in-the-loop consent gate by forwarding a non_interactive_mode keyword argument through the batch tool. This can lead to arbitrary Python code execution on the agent's host without human approval, effectively defeating a key safety control. Upgrading to version 0.8.5 or later remediates the issue.

Updated Aug 26, 2026 · CVSS 8.1

mcp-shell, an MCP server designed to run shell commands securely, contains a filter bypass that allows a malicious or compromised caller to execute arbitrary OS commands via a crafted Git alias, even with 'secure mode' enabled. Because the default Docker deployment includes Git and runs the vulnerable filters out of the box, any agent or user with MCP connectivity to the tool can achieve full arbitrary code execution as the mcpuser process. This is a critical tool-layer vulnerability affecting the trust boundary between an AI agent and the command-execution tool it calls.

Updated Aug 25, 2026 · CVSS 8.4

QWED, an infrastructure component used to verify LLM/agent tool outputs and math expressions before production execution, passes untrusted expressions directly to SymPy's parse_expr() without restricting namespaces, allowing arbitrary Python code execution in the API server. Because signup and API key issuance are open by default, any external attacker can register a tenant, obtain a valid API key, and trigger remote code execution via the math verification endpoints, fully compromising the server and other tenants in shared deployments.

Updated Aug 25, 2026 · CVSS 8.8

browse-mcp, an MCP server that gives agents headless-browser capabilities, fails to validate caller-controlled save paths in its browser_download, browser_save_state, and browser_load_state tools, allowing arbitrary file writes anywhere the process can reach. An attacker who controls a webpage the agent visits can use indirect prompt injection to steer the agent into writing attacker-controlled content to sensitive locations like ~/.bashrc or cron files, potentially achieving full host code execution. A separate flaw in the force_fetch fallback also bypasses the configured origin allowlist entirely.

Updated Aug 25, 2026

Omnigent, an open-source AI agent orchestration framework, fails to validate the dotted Python path an authenticated user supplies for a tool callable when uploading an agent bundle. This allows a low-privilege authenticated user to point a tool at dangerous built-ins like subprocess.check_output, achieving arbitrary command execution with the runner's permissions. The result is full compromise of the runner process, including credentials, environment variables, workspace data, and internal service access.

Updated Aug 22, 2026 · CVSS 8.8

Neo.mjs's file-system MCP server contains a command injection flaw where two exposed tools build shell commands from unsanitized file paths. An AI agent that is tricked or manipulated into calling these tools with a malicious path can trigger arbitrary OS command execution on the host running the MCP server. This is a serious vulnerability because it turns a routine agent tool call into full system compromise.

Updated Aug 20, 2026

A vulnerability in the Splunk MCP Server app (versions below 1.2.1) allows a user with the admin Splunk role to execute arbitrary operating system commands. The flaw stems from unsafe deserialization of stored credential data without type validation. This gives an already-privileged user a path to full host compromise via the MCP integration layer.

Updated Aug 20, 2026 · CVSS 9.1

A critical vulnerability in the marimo notebook application allows an attacker to achieve arbitrary command execution simply by getting a victim to open a malicious notebook file in edit mode. The malicious payload is hidden inside an MCP server configuration entry and is launched as a subprocess automatically, with no authentication and no need to run any notebook cell.

Updated Aug 20, 2026 · CVSS 8.8

CodeWhale's rlm_eval tool is misconfigured to always auto-approve code execution, bypassing the user's approval policy entirely. An attacker who can plant instructions in content the agent reads (a webpage, repo file, or MCP tool result) can trigger arbitrary Python execution on the user's machine at the user's privilege level, with no prompt or audit trail. This is a straightforward and highly exploitable prompt-injection-to-RCE chain fixed in version 0.8.64.

Updated Aug 18, 2026 · CVSS 7.8

MindsDB Minds Platform (v26.1.0 and earlier) has an unauthenticated remote code execution vulnerability where attackers can configure their own LLM key via an unprotected settings endpoint, then submit a crafted prompt that directs the 'Anton' agent to invoke its scratchpad tool, which calls exec() on attacker-controlled Python code without sandboxing. This grants full OS command execution as the user running the application, exposing SSH keys, credentials, and environment secrets. This is a critical, fully unauthenticated, trivially exploitable vulnerability warranting immediate patching.

Updated Aug 15, 2026 · CVSS 10