Unsafe Code Execution

The Cortex MCP server incorrectly trusts the CLAUDE_PROJECT_DIR environment variable to identify a legitimate Cortex source checkout, using only two file-presence checks as validation. An attacker who convinces a victim to open a malicious repository as their active project in Claude Code can plant these marker files and cause Cortex's open_visualization tool to execute an arbitrary attacker-controlled Python script with the victim's local user privileges.

Updated Aug 14, 2026

Flowise versions before 3.1.3 have a flawed regex-based code validator in the CSV and Airtable Agent nodes that fails to block dangerous pandas functions such as pd.read_json(). Attackers can use prompt injection to smuggle malicious Python code through these nodes without authentication, leading to arbitrary code execution, internal SSRF, and data exfiltration. Because the vulnerable prediction API requires no authentication, this is a low-effort, high-impact attack path against any exposed Flowise instance.

Updated Aug 13, 2026

Flowise before version 3.1.3 has a critical vulnerability in its Airtable Agent node where crafted chatflow prompts can bypass a Python code validator blocklist and execute arbitrary code in an unsandboxed pyodide environment. Since this requires no authentication and grants full host OS access, an attacker can achieve remote code execution simply by sending malicious input to a public-facing chatflow.

Updated Aug 13, 2026

PapersGPT for Zotero 0.6.1 passes unsanitized LLM output directly to window.eval(), allowing arbitrary JavaScript execution in Zotero's privileged chrome context. An attacker can trigger this via prompt injection embedded in a PDF the AI agent reads, a man-in-the-middle on API traffic, or a malicious custom LLM endpoint, resulting in full compromise of the Zotero installation including file read/write and process execution.

Updated Aug 12, 2026 · CVSS 9.6

The `goose review` command in the goose AI agent invokes Git in a way that trusts repository-local configuration, allowing a malicious repository to execute arbitrary commands on the host simply by being reviewed. This happens automatically before any model interaction, prompt, or tool-approval step, bypassing goose's entire trust and permission model. An attacker can exfiltrate secrets, API keys, and modify files with the privileges of the user running goose.

Updated Aug 10, 2026

The mcp-bridge-api project contains a command injection vulnerability in its Servers Endpoint, where the command/args parameters passed to mcp-bridge.js are not properly sanitized. A remote attacker can exploit this to execute arbitrary operating system commands on the host running the MCP bridge. This directly compromises the underlying system that mediates tool access for AI agents using MCP.

Updated Aug 8, 2026 · CVSS 7.3

A reported command injection flaw in the ssh_exec function of the ssh-mcp-server project involves unsanitized host/username parameters, but exploitation requires local access and the maintainer disputes it represents a real security boundary violation. Since the tool is explicitly designed as a trusted local component granting the calling agent shell-level execution capability, this does not constitute a meaningful privilege escalation. Severity is assessed as low given the disputed status, local-only attack vector, and lack of a genuine trust boundary crossing.

Updated Aug 7, 2026 · CVSS 5.3

IBM Langflow OSS versions 1.0.0 through 1.10.3 execute LLM-generated Python code on the backend during Agentic Assistant validation, before a human approves it. An authenticated attacker can abuse this to run arbitrary code with backend privileges, potentially exfiltrating data or reaching internal network resources.

Updated Aug 6, 2026 · CVSS 8.1

FrontMCP's sandboxed script execution tool leaks a live host Zod schema object due to a JavaScript Proxy invariant limitation, allowing scripts to reach the Function constructor and execute arbitrary code on the MCP server. Because the framework defaults to public (unauthenticated) mode, a single malicious tool call can achieve full remote code execution and exfiltrate OAuth secrets, JWT keys, and database credentials; on authenticated deployments, this can also be triggered via indirect prompt injection without any human attacker involvement.

Updated Aug 6, 2026

IBM Langflow, an open-source visual builder for AI agent/LLM workflows, contains an OS command injection flaw exploitable by an authenticated remote attacker to run arbitrary commands on the host. Because Langflow orchestrates agent pipelines and often has access to credentials, tools, and downstream systems, a compromise here can cascade into broader agent infrastructure. The CVSS 7.2 score reflects high impact but a requirement for authenticated access, moderating the overall risk.

Updated Aug 5, 2026 · CVSS 7.2

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability where the 'command' field in MCP server configurations is not properly validated, allowing a remote authenticated attacker to execute arbitrary commands on the host system. This is a genuine and serious flaw since it turns a legitimate agent-tooling feature (MCP server setup) into a direct code execution path, though it does require prior authentication to exploit.

Updated Aug 5, 2026 · CVSS 8.8

CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, most notably a code injection flaw in IBM Langflow, a popular framework for building AI agent workflows. This is a genuine, confirmed security issue (active exploitation) requiring urgent patching, though the underlying advisory is a routine government vulnerability notification rather than a novel agentic-AI attack technique.

Updated Aug 5, 2026

Flowise's MCP security check uses a flag-blocklist and a four-item environment-variable blocklist to prevent malicious npx/node/python invocations, but npm's env-based configuration (e.g. npm_config_yes) reproduces blocked flag behavior and slips past the filter entirely. Because default Flowise deployments have no authentication, any unauthenticated attacker who can reach the Flowise API can supply an MCP server config that auto-installs and executes an arbitrary package, achieving remote code execution with the privileges of the Flowise process. This is a bypass of the prior fix for CVE-2025-8943, not a new class of bug.

Updated Aug 4, 2026

Flowise's CSV Agent and Airtable Agent allow LLM-generated Python code to run inside a Pyodide sandbox, gated by a regex blacklist meant to block dangerous constructs like __class__ or __import__. Because JavaScript's regex word boundaries are ASCII-only while Python 3 normalizes Unicode homoglyph identifiers (e.g., mathematical bold letters) to their ASCII equivalents, attackers can craft identifiers that bypass the filter but execute as the forbidden built-ins in Python, leading to full arbitrary code execution on the host running Flowise.

Updated Aug 4, 2026

Flowise's CSVAgent node builds a Python script by unsafely interpolating an attacker-controlled base64 segment from a CSV file's data URI, allowing an attacker to break out of the Python string literal. Because Pyodide is configured with default Node.js bridging (exposing eval and dynamic import), the injected code escapes the WASM sandbox entirely and executes arbitrary file system and OS command operations on the host running Flowise. Any user who can create or modify a chatflow can plant this payload, and once the chatflow is exposed via the public prediction API, any unauthenticated request triggers full host compromise.

Updated Aug 4, 2026

Ouroboros, a local-first runtime for AI coding agents, blindly trusts a .env file found in the current working directory to configure execution-critical CLI backend paths. A malicious repository can set a variable like OUROBOROS_CLI_PATH to point at an attacker-controlled script, which then executes automatically when the victim runs basic Ouroboros commands. This is a classic untrusted-repository-triggers-code-execution supply chain flaw, fixed in version 0.39.0.

Updated Aug 4, 2026

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical vulnerability allowing a remote, likely unauthenticated attacker to inject and execute arbitrary code due to improper handling of user-supplied input. Given the near-maximum CVSS score of 9.9, this represents a severe risk to any environment running affected Langflow instances, potentially exposing the underlying host, connected agent pipelines, and any credentials or tools accessible to the Langflow server.

Updated Jul 31, 2026 · CVSS 9.9

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper input validation flaw in the PythonREPL sandbox tool, allowing an attacker to escape the intended execution boundary. Given the CVSS score of 9.9, this likely enables arbitrary code execution on the host running the Langflow agent, posing a critical risk to any deployment exposing this component. Organizations running affected versions should treat this as an urgent patching priority.

Updated Jul 31, 2026 · CVSS 9.9

Langflow's MCP stdio launcher fails to block dangerous shell environment variables (SHELLOPTS, BASHOPTS, PS4), allowing unauthenticated remote attackers to achieve arbitrary code execution. This is a critical, easily exploitable flaw in a widely used agent orchestration framework's tool-invocation layer.

Updated Jul 30, 2026 · CVSS 9.8

A maximum-severity vulnerability (CVSS 10.0) in Ruflo, an open-source meta-harness used to orchestrate Claude Code and OpenAI Codex agents via MCP, allows unauthenticated attackers to remotely execute arbitrary commands and poison the agent's persistent memory. This flaw, dubbed RufRoot, affects all versions prior to 3.16.3 and poses severe risk to any deployment exposing the Ruflo MCP interface without proper authentication controls.

Updated Jul 30, 2026 · CVSS 10