Tool Misuse

This CVE describes a terminal escape sequence injection vulnerability in the Oh My Posh shell prompt renderer, not an AI agent-specific prompt injection despite the matched keyword. Attacker-controlled Git metadata (commit messages, author names, repo URLs) and directory names could contain unsanitized control characters that manipulate the terminal, spoof the display, or overwrite the clipboard when a victim's shell prompt renders that data. This is a legitimate but conventional software vulnerability with no direct relevance to AI agent architectures, LLM prompt injection, or inter-agent protocols.

Updated Aug 13, 2026 · CVSS 6.1

The MCP Atlassian server before version 0.22.0 fails to validate file paths passed to its confluence_upload_attachment tool, allowing an authenticated MCP client (or an AI agent manipulated via untrusted content) to read arbitrary files on the server and exfiltrate them as Confluence attachments. This can expose sensitive server environment variables like CONFLUENCE_API_TOKEN, turning a routine file-upload feature into a credential theft and data exfiltration primitive.

Updated Aug 13, 2026 · CVSS 7.7

A vulnerability in n8n's MCP Client node allows authenticated users to bypass built-in SSRF protections, enabling requests to internal or otherwise blocked network hosts. This lets an attacker probe or exfiltrate data from internal services that should be shielded from external-facing workflows, using the MCP tool integration as the pivot point.

Updated Aug 11, 2026

The mcp-grafana MCP server allows a caller to control the destination host, HTTP method, path, and body of outbound requests via the X-Grafana-URL header and the grafana_api_request tool, enabling server-side request forgery against internal, loopback, and cloud metadata services. This is an incomplete fix for a prior vulnerability (CVE-2026-15583) that stopped credential leakage but left the underlying destination-control flaw unpatched. Given the 9.1 CVSS score and potential for cloud credential theft via metadata endpoints, this is a critical, actively exploitable issue.

Updated Aug 11, 2026 · CVSS 9.1

An MCP server tool (read_webpage) fails to validate the 'url' argument, allowing server-side request forgery when a malicious or manipulated URL is passed to it. Exploitation requires local access, which limits severity but still poses risk in multi-tenant or agent-orchestrated environments where untrusted input reaches this tool. A patch is available and should be applied.

Updated Aug 9, 2026 · CVSS 5.3

A vulnerability in Amazon Strands Agents Tools allows an authenticated user to manipulate the LLM into calling memory-management tools with a forged namespace parameter, letting them read, modify, or delete another tenant's stored memories. This is an insecure direct object reference (IDOR) bug affecting the mongodb_memory, elasticsearch_memory, and mem0_memory tool integrations before version 0.8.3. It poses a serious confidentiality and integrity risk in any multi-tenant deployment of these agent tools.

Updated Aug 7, 2026 · CVSS 8.1

Flowise's S3 Directory (and related S3File) document loader fails to sanitize S3 object keys before writing them to a local temp directory, allowing an authenticated user with document-store preview permissions to write attacker-controlled files anywhere on the host filesystem via path traversal sequences like '../'. Because cleanup only removes the original temp directory, malicious files persist, giving an attacker a path to arbitrary file write and potentially remote code execution on the Flowise server. This is a classic tool-layer vulnerability in an agentic/RAG framework rather than a model-level prompt injection issue.

Updated Aug 4, 2026

The new datasette-agent release adds a browser_task mechanism that lets agent tools run arbitrary JavaScript directly in the user's browser. This significantly expands the agent's capability surface into the client-side execution context, meaning a compromised or malicious tool/plugin, or a prompt-injected agent, could execute code with the user's browser session privileges (cookies, DOM, same-origin requests). This is not confirmed to be exploited, but the architecture introduces a new high-value attack surface that warrants scrutiny.

Updated Aug 1, 2026

The gemini-bridge MCP server, which connects AI agents to Google's Gemini CLI, failed to restrict file paths passed to its consult_gemini_with_files tool in inline mode. This allowed any file on the host filesystem to be read and forwarded through the Gemini round-trip, effectively exfiltrating local file contents to an external third party (Google) via a trusted tool call. The issue is fixed in version 1.3.1.

Updated Aug 1, 2026 · CVSS 6.2

A vulnerability in the http_request tool of Strands Agents Tools (before 0.8.2) allows an attacker who can influence the LLM's tool inputs to redirect outbound HTTP requests through an attacker-controlled proxy, causing credentials configured via HTTP_REQUEST_TOKEN_CONFIG to be sent to that proxy. This effectively lets prompt-level manipulation of an agent result in real credential theft. Users should upgrade to 0.8.2 immediately.

Updated Aug 1, 2026 · CVSS 7.4

Google's mcp-toolbox contains an SSRF vulnerability in its generic HTTP tool/source component: the underlying HTTP client follows redirects without validating destination IPs or hosts, allowing crafted path parameters to redirect requests to internal or arbitrary external endpoints. This is especially dangerous in MCP deployments because a malicious or data-driven prompt could supply the crafting input, letting an LLM-invoked tool call pivot into internal network reconnaissance or cloud metadata access.

Updated Jul 31, 2026

Pydantic AI's UI adapters (AG-UI and Vercel AI) had a message-sanitization bug where a stale index calculation allowed a crafted client message history to reintroduce an unresolved, client-controlled tool call as if it were the model's own output. This let a remote client trigger execution of registered server tools with attacker-chosen arguments, bypassing model-request guardrail hooks, though approval-gated tools were not affected. The vendor has patched this in 1.107.1 and 2.5.0.

Updated Jul 30, 2026 · CVSS 6.5

Flyto2 Core, an execution kernel for AI-agent workflows, contains a widespread SSRF vulnerability where numerous HTTP-emitting modules (HTTP requests, GraphQL, notifications, monitoring, vision analysis, browser proxying, and LLM/agent base_url handling) fail to validate caller-supplied URLs. This allows an attacker who can influence tool input or agent-generated parameters to force the agent to make requests to internal services or cloud metadata endpoints, potentially leaking credentials or pivoting into internal networks. The issue is fixed in version 2.26.7.

Updated Jul 30, 2026 · CVSS 8.5

This is an academic arXiv paper proposing MTGuard, a defensive hybrid static-dynamic analysis framework for securing MCP tool use in LLM agents, not a description of an active exploit or newly disclosed vulnerability. It generically references the known risk class that MCP tools can be induced to perform malicious or unauthorized actions, but provides no specific exploit details, affected products, or CVEs. Severity is low because this is defensive research rather than a genuine actionable threat report.

Updated Jul 29, 2026

Kimi Code's FetchURL tool uses a static hostname/IP denylist to prevent server-side request forgery, but it never resolves DNS or re-checks the target after HTTP redirects, so an attacker can trick the agent into fetching internal resources anyway. Because FetchURL is auto-approved by default, an attacker who controls or injects content into the agent's context (e.g., via prompt injection) can trigger this without any user confirmation. This effectively turns a hardened-looking safety control into a bypassable one, exposing internal network services to the LLM agent's network position.

Updated Jul 27, 2026 · CVSS 5.5

A threat actor reportedly leveraged the open-source Hermes AI agent running in an unattended 'YOLO' (no human confirmation) mode to automate post-exploitation actions during a breach of Thailand's Ministry of Finance. This represents real-world weaponization of agentic AI frameworks to accelerate attacker operations rather than a novel vulnerability in the agent itself, but it highlights the risk of autonomous, unsupervised agents executing tools with elevated privileges against production/government systems.

Updated Jul 25, 2026

The Void AI coding agent's file-reading tools (read_file, ls_dir, get_dir_tree, search_*) fail to confine access to the intended workspace, allowing absolute paths or file:// URIs to reach arbitrary host files. Combined with prompt injection from processed content, an attacker can trick the agent into silently reading and exfiltrating sensitive files like SSH keys or cloud credentials, bypassing the human approval gate. This is a high-severity issue because it enables credential theft with limited attacker interaction and no clear victim-visible warning.

Updated Jul 23, 2026 · CVSS 5.3

The @n8n/computer-use file-search tool used by AI agent workflows in n8n failed to properly confine search patterns to a designated base directory, allowing crafted inputs to escape the sandbox and read arbitrary files accessible to the daemon's OS user. This affects any deployment where an untrusted actor or agent-driven input could influence the search query, resulting in local file disclosure outside the intended scope. The issue has been patched in n8n 2.31.5 and 2.32.1.

Updated Jul 23, 2026

A legacy MySQL node in the n8n workflow automation platform builds raw SQL queries by directly interpolating expression-evaluated values instead of using parameterized queries. When such a workflow is triggered by an externally reachable input like a webhook, an attacker can inject SQL to read, modify, or delete data via the configured database credentials.

Updated Jul 23, 2026

The n8n computer-use package's shell tool was supposed to restrict filesystem and network access via a sandbox, but this enforcement only worked on macOS. On Linux and Windows, any command executed by the agent's shell tool ran with full, unrestricted access to the host filesystem and network, defeating the intended containment. This is only relevant to deployments that explicitly enable the computer-use package.

Updated Jul 23, 2026