Unsafe Code Execution

The Fay AI agent framework (version 4.3.1) exposes its MCP server management interface without adequate access control, allowing remote attackers to register a malicious MCP STDIO server with attacker-controlled commands. This results in full arbitrary command execution on the host running the Fay service, making it a critical, easily exploitable remote code execution vulnerability.

Updated Jul 17, 2026 · CVSS 9.8

Penpot's MCP server component exposed an unauthenticated HTTP endpoint bound to all network interfaces that allowed arbitrary JavaScript execution on the host. Any network-adjacent attacker could remotely execute code without credentials, making this a critical, easily exploitable vulnerability in an agent-tooling component.

Updated Jul 15, 2026 · CVSS 8.8

Cursor's browser-enabled Cloud Agent exposed a local agent control endpoint without authentication, allowing malicious web content encountered by the agent's browsing capability to reach it from inside the sandbox. This let attacker-controlled pages trigger code execution within the agent's session and steal repository files, environment variables, credentials, and GitHub App tokens. The vendor fixed the issue by requiring authentication on the endpoint.

Updated Jul 15, 2026

PraisonAI's CodeAgent executes LLM-generated Python code with no AST validation, import restrictions, or sandboxing, allowing an attacker who can influence the LLM's output via prompt injection to achieve full remote code execution on the host. This gives attackers a direct path to exfiltrate all environment secrets and compromise the underlying system, making it a maximum-severity flaw.

Updated Jul 11, 2026 · CVSS 10

Langroid versions before 0.65.2 contain a critical flaw where LLM-generated tool messages evaluated via Python's eval() with a supposedly empty 'locals' dict can still access all built-in functions, since '__builtins__' is implicitly injected into globals. This allows any attacker capable of influencing LLM output (e.g., via prompt injection) to achieve full unauthenticated remote code execution on the host running the agent.

Updated Jul 10, 2026 · CVSS 10

9Router, a platform used to manage/orchestrate agent-related infrastructure, has a critical unauthenticated remote code execution flaw in its tunnel installation endpoint. An attacker can send a crafted 'sudoPassword' field that gets fed directly into a shell process, resulting in arbitrary OS command execution as root in many configurations. This is a classic infrastructure vulnerability with severe impact, already showing exploitation evidence in the wild.

Updated Jul 8, 2026 · CVSS 9.8