Tool Misuse

OpenAI Codex CLI and Desktop failed to correctly parse PowerShell's stop-parsing token (--%), causing malicious commands to be misclassified as safe and auto-approved. An attacker who gets a user to open a poisoned repository can trick Codex into running an unapproved file-writing Git command that rewrites Codex's own configuration, ultimately allowing it to launch an attacker-controlled MCP server and execute code with the user's privileges.

Updated Sep 4, 2026 · CVSS 8.8

This is an academic research paper describing a hybrid AI architecture that combines a multimodal LLM with deterministic computer-vision tools via MCP to solve darknet-style CAPTCHAs with high accuracy. It is not an active exploit or an attack on AI agents/infrastructure itself, but a dual-use capability that could be repurposed to automate access to illicit darknet marketplaces or services. There is no vulnerability in an agent framework, protocol, or inter-agent trust boundary being described here.

Updated Sep 1, 2026

An MCP server tool that fetches URLs on behalf of callers only validated the URL scheme and syntax, not the destination host or resolved IP address. This allowed any caller of the MCP server to force it to request internal-only endpoints, including cloud instance metadata services, and read back sensitive data such as cloud credentials.

Updated Aug 29, 2026 · CVSS 8.6

SiYuan's asset.upload MCP tool fails to validate that file paths stay within the intended workspace, allowing an attacker to use prompt injection to trick the AI agent into pulling sensitive files like SSH keys from outside the workspace into an accessible asset directory. This effectively turns a benign file-upload tool into a data exfiltration primitive controllable via untrusted text fed to the agent.

Updated Aug 28, 2026 · CVSS 5.7

A vulnerability in GitLab's AI Gateway allowed an authenticated user with access to the Duo Agent Platform to redirect model inference requests to an attacker-controlled endpoint by crafting model metadata. This could leak sensitive Google Vertex AI or AWS Bedrock cloud service credentials to the attacker's server. GitLab has already remediated the issue in patched versions.

Updated Aug 27, 2026 · CVSS 8.2

MCP tools in the sublinear-time-solver and consciousness-explorer packages accept a user-supplied file path parameter and pass it directly to filesystem operations without validating or restricting the destination. This allows any client able to invoke these MCP tools to read, write, or overwrite arbitrary files accessible to the server process, leading to data exposure, tampering, or service disruption. The issue is fixed in later versions of both packages.

Updated Aug 26, 2026 · CVSS 7.1

The mcp-shell MCP server, intended to safely execute allowlisted shell commands on behalf of an AI agent, fails to properly validate command arguments when the executable is bash. An attacker or a compromised/malicious agent can invoke the shell_exec tool with '/bin/bash -c <command>' to run arbitrary commands as the mcpuser, completely bypassing the intended security allowlist. This is a high-severity tool-layer vulnerability that gives an attacker code execution wherever the fixed pre-0.6.0 mcp-shell server is deployed.

Updated Aug 25, 2026 · CVSS 8.4

mcp-shell, an MCP server that exposes shell command execution to LLM agents, ships with security disabled by default and the documented installation steps never enable it. As a result, any LLM or agent connected to a default deployment can run arbitrary OS commands as the mcp-shell process user, giving effectively unrestricted remote code execution through a trusted tool interface. The issue is fixed in version 0.6.0.

Updated Aug 25, 2026

The Continue CLI's headless/auto mode relies solely on an incomplete denylist to block dangerous shell commands, missing paths like /home, /root, /var, and failing to properly handle variable expansion such as $HOME. An attacker who can inject instructions into content the agent reads (web pages, repo files, issues) can trigger destructive commands like recursive deletion, causing unattended agent runs to destroy user data.

Updated Aug 25, 2026 · CVSS 7.4

The CKAN MCP Server's earlier SSRF fix only blocked the literal hostname 'localhost' and dotted IPv4/bracketed IPv6 loopback literals, but missed alternate hostname aliases like 'ip6-localhost' and 'ip6-loopback' that resolve to loopback addresses. A remote caller invoking CKAN tools (e.g. ckan_package_search, sparql_query) with a crafted server_url/base_url parameter could bypass the filter and force the server to make requests to internal or loopback network locations. This is a moderate-severity SSRF bypass affecting a specific tool integration, not a novel or high-impact agentic exploitation technique.

Updated Aug 22, 2026 · CVSS 5.7

Infracost's template functions used by AI coding agents and CI/CD pipelines fail to properly resolve intermediate directory symlinks, allowing a malicious repository to trick the tool into reading arbitrary files accessible to the CI runner, including secrets. The leaked content can then be surfaced in the Infracost dashboard or pull request comments, creating a data exfiltration path. This is a classic path traversal/symlink vulnerability in a tool commonly invoked by AI agents and CI automation, fixed in version 0.10.45.

Updated Aug 22, 2026

LangChain's SitemapLoader fails to apply its restrict_to_same_domain protection to nested sitemap references, only filtering leaf URLs. An attacker who can influence an ingested sitemap can point a nested <sitemap> element at internal or loopback addresses, causing the agent's backend to fetch and return that internal content to the caller. This is a server-side request forgery that defeats a documented security control and can leak internal network data.

Updated Aug 21, 2026 · CVSS 8.6

Agno's PythonTools contains a path traversal flaw that lets an attacker escape the intended sandboxed base_dir by supplying '../' sequences in file arguments to read_file, save_to_file, or run_python_file. This can be triggered either through direct tool calls or by embedding traversal payloads in content the agent processes (prompt injection), resulting in arbitrary file read, write, or code execution at the privilege level of the agent process. Given the high CVSS score and ease of exploitation, this is a critical, actively exploitable vulnerability rather than a theoretical concern.

Updated Aug 20, 2026 · CVSS 8.8

A flaw in the CodeWhale agent framework causes the exec_shell_interact tool to skip the mandatory human-approval step for code execution, defaulting it to auto-approved. This lets attacker-controlled content ingested by the agent (e.g., a malicious web page, MCP tool result, or repo file) inject commands that execute silently inside an already-approved privileged shell session such as sudo, ssh, or a database console. Fixed in version 0.8.64.

Updated Aug 18, 2026 · CVSS 7

CodeWhale's git_show tool passes an LLM-controlled 'rev' parameter directly into git's command line without sanitization, allowing a value like '--output=~/.ssh/authorized_keys' to be interpreted as a git flag rather than a revision. Because the tool is auto-approved and marketed as read-only, a malicious repository combined with prompt injection can trick the agent into silently overwriting sensitive files with attacker-controlled content, effectively achieving persistence or account takeover at the user's privilege level. This is a critical, easily exploitable vulnerability with a working fix already available in version 0.8.64.

Updated Aug 18, 2026 · CVSS 9.3

The mcp-florence2 MCP server contains a server-side request forgery vulnerability in its get_images function, allowing a remote attacker to supply a malicious 'src' argument that causes the server to make unauthorized HTTP requests. This could be used to probe internal networks, access cloud metadata endpoints, or interact with internal services reachable by the MCP server. A public exploit exists, increasing the urgency of remediation.

Updated Aug 17, 2026 · CVSS 6.3

The CKAN MCP Server's data quality tools validate the server_url parameter using a prefix-only regular expression intended to restrict requests to dati.gov.it, but the check can be bypassed with suffix-host or userinfo tricks in the URL. This allows an attacker to redirect the MCP tool's outbound request to an attacker-controlled host and return spoofed data to the agent as if it came from the trusted source.

Updated Aug 15, 2026 · CVSS 5.3

An MCP server tool called parse-csv accepts a user-supplied URL (csvUrl) and fetches it with axios.get without validating the destination, allowing an attacker to force the server to make requests to arbitrary internal or external endpoints. This is a classic server-side request forgery (SSRF) vulnerability exposed through an agent tool interface, remotely exploitable, with a public exploit and no vendor response yet. Severity is moderate given CVSS 6.3, but the risk is amplified in agent contexts where the MCP server may have network access to internal services, cloud metadata endpoints, or other agents.

Updated Aug 14, 2026 · CVSS 6.3

The auth-fetch-mcp server, which lets AI assistants fetch authenticated web content, has a flawed SSRF blocklist that fails to catch IPv4-mapped IPv6 loopback addresses in their hex-normalized form. An attacker who can influence the URL passed to the fetch tool (directly or via prompt injection) can reach internal loopback services that the security control was explicitly designed to block. This is exploitable out-of-the-box with no special configuration.

Updated Aug 13, 2026 · CVSS 7.4

The jshookmcp MCP server enforces an SSRF policy that blocks access to private and internal network addresses for most of its raw network tools, but the ICMP probe and traceroute tools bypass this policy entirely. This lets any MCP client with access to the network domain map internal network topology and probe internal hosts, even when private network access is explicitly disabled by policy.

Updated Aug 13, 2026 · CVSS 4.3