31 Mar 2026 · LangChain
Prior to langchain-core 1.2.22, functions in langchain_core.prompts.loading read files from paths embedded in deserialized prompt configs without validating against directory traversal or absolute paths, letting an attacker supplying user-influenced configs to load_prompt() or load_prompt_from_config() read arbitrary files (limited to .txt, .json and .yaml extensions). The issue was patched in version 1.2.22.
other·data leak·
31 Mar 2026 · 1millionbot
A prompt injection vulnerability (CVE-2026-4399) in the 1millionbot Millie chatbot lets attackers bypass chat restrictions using Boolean prompt injection techniques, causing the bot to return prohibited or out-of-context information. Successful exploitation could allow abuse of 1millionbot's resources and/or OpenAI API key for unintended tasks.
customer service·prompt injection·
31 Mar 2026 · agentic-context-engine project
A directory traversal flaw in the agentic-context-engine project (versions up to 0.7.1) lets the checkpoint_dir parameter in OfflineACE.run escape the intended directory because save_to_file in ace/skillbook.py does not normalise or validate paths. Attackers can overwrite arbitrary files accessible to the application process, potentially causing corruption, privilege escalation or code execution.
other·tool misuse·
31 Mar 2026 · labring
FastGPT versions before 4.14.9.5 exposed an unauthenticated HTTP tools testing endpoint that acted as a full server-side HTTP proxy, and MCP tools endpoints that made server-side requests to user-supplied URLs without internal-address validation, enabling SSRF against internal networks, cloud metadata services, MongoDB and Redis. Both issues were patched in version 4.14.9.5.
workflow·misconfiguration·
31 Mar 2026 · Giskard
Giskard, an open-source Python library for testing and evaluating agentic systems, passed the string argument of ChatWorkflow.chat(message) directly to a non-sandboxed Jinja2 environment, so any user input reaching that method could achieve remote code execution via Jinja2 class traversal. The issue (CVE-2026-34172) was patched in versions 0.3.4 and 1.0.2b1.
other·misconfiguration·
31 Mar 2026 · Nhost
Prior to version 1.41.0, the Nhost CLI MCP server applied no inbound authentication and did not enforce strict CORS when explicitly configured to listen on a network port, letting a malicious website invoke privileged MCP tools with the developer's local credentials. Exploitation required two non-default configuration steps; the issue was patched in version 1.41.0.
coding·misconfiguration·
31 Mar 2026 · Model Context Protocol
Two vulnerabilities disclosed in the official Model Context Protocol SDKs: the Java SDK shipped a hardcoded wildcard CORS policy (CVE-2026-34237) and the Go SDK did not enable DNS rebinding protection by default for HTTP-based servers (CVE-2026-34742), letting a malicious website reach an unauthenticated local MCP server and invoke its tools or resources. Both issues were patched in updated SDK releases.
other·misconfiguration·
31 Mar 2026 · Anthropic
The local filesystem memory tool in the Anthropic Claude SDK for TypeScript (versions 0.79.0 to before 0.81.0) validated model-supplied paths with a string prefix check lacking a trailing path separator, so a model steered by prompt injection could read and write files in sibling directories outside the sandboxed memory root. The issue was patched in version 0.81.0.
other·prompt injection·
30 Mar 2026 · Nginx UI
Nginx UI versions 2.3.5 and prior expose an /mcp_message Model Context Protocol endpoint that is protected only by an IP whitelist which defaults to empty and is treated as allow-all, letting any network attacker invoke all MCP tools without authentication. This permits restarting nginx and creating, modifying or deleting nginx configuration files with automatic reloads, amounting to complete service takeover; no patch was available at publication.
workflow·misconfiguration·
28 Mar 2026 · PromtEngineer
A prompt injection vulnerability (CVE-2026-5002) was disclosed in PromtEngineer's localGPT, affecting the _route_using_overviews function in backend/server.py of the LLM Prompt Handler component. The flaw can be exploited remotely and the exploit has been made public; the vendor did not respond to the disclosure.
other·prompt injection·
27 Mar 2026 · OpenHands
CVE-2026-33718 describes a command injection flaw in OpenHands' get_git_diff() method, where the unsanitized `path` parameter from the /api/conversations/{conversation_id}/git/diff endpoint is passed to a shell command. Authenticated attackers could execute arbitrary commands in the agent sandbox, bypassing normal agent channels; version 1.5.0 fixes the issue.
coding·tool misuse·
27 Mar 2026 ·
Four AI coding assistants (AI Code, SakaDev, HAI Build Code Generator and Sixth) let the model auto-execute terminal commands it judges 'safe'. Researchers showed a generic prompt-injection template can wrap any malicious command so the model misclassifies it as safe, bypassing user approval and allowing arbitrary command execution.
coding·prompt injection·
27 Mar 2026 · LibreChat
Two vulnerabilities in LibreChat's agent actions and Model Context Protocol support allow attackers to bypass SSRF protections to reach internal resources (CVE-2026-31945) and to exfiltrate victims' OAuth tokens via credential placeholder substitution in attacker-created MCP server headers (CVE-2026-31951). Patches are available in versions 0.8.3-rc1 and 0.8.3-rc2 respectively.
other·tool misuse·
27 Mar 2026 · HKUDS
An indirect prompt injection vulnerability in the email channel module of the nanobot personal AI assistant (prior to version 0.1.6) let a remote, unauthenticated attacker send an email to the bot's monitored address and have its contents processed as trusted input, executing arbitrary LLM instructions and system tools with no owner interaction. The issue was patched in version 0.1.6.
other·prompt injection·
27 Mar 2026 · pab1it0 (adx-mcp-server project)
The Azure Data Explorer MCP Server (versions up to and including 0.1.1) interpolated the `table_name` parameter directly into KQL queries in three tool handlers, letting an attacker or a prompt-injected AI agent run arbitrary KQL against the ADX/Kusto cluster; a related advisory, CVE-2026-32211, reports missing authentication in Microsoft's Azure MCP Server allowing unauthorized information disclosure. A commit patches the KQL injection issue.
other·tool misuse·
27 Mar 2026 · Mobile Next
The @mobilenext/mobile-mcp server passed the `saveTo` and `output` parameters of its `mobile_save_screenshot` and `mobile_start_screen_recording` tools directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. The issue was fixed in version 0.0.49.
workflow·tool misuse·
23 Mar 2026 · Blinko
Blinko, an AI-powered card note-taking project, allowed arbitrary commands and arguments to be specified when creating an MCP (Model Context Protocol) server, which were then executed when the connection was tested. The issue affects versions prior to 1.8.4 and has been patched in that release.
workflow·tool misuse·
22 Mar 2026 · apconw
A SQL injection flaw (CVE-2026-4530) was disclosed in apconw Aix-DB up to version 1.2.3, affecting the agent/text2sql/rag/terminology_retriever.py component via manipulation of the Description argument. The attack requires local access, a public exploit has been released, and the vendor did not respond to the disclosure.
other·unknown·
20 Mar 2026 · Langflow
A batch of CVEs disclosed in March 2026 affects Langflow, an AI agent and workflow builder, headlined by CVE-2026-33017, an unauthenticated remote code execution flaw in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint that passes attacker-supplied node code to exec() without sandboxing. Related issues include arbitrary file write leading to RCE, code execution via the Agentic Assistant's validation phase, cross-tenant flow and image access, path traversal exposing the secret key, and CI shell injection; most are patched in version 1.9.0.
workflow·excessive permissions·
20 Mar 2026 · ondata
Versions of the CKAN MCP Server prior to 0.4.85 accepted an arbitrary base_url in tools such as ckan_package_search, sparql_query and ckan_datastore_search_sql, with no URL validation or blocking of private/link-local addresses. An attacker able to influence the parameter via prompt injection could scan internal networks, steal cloud metadata credentials from 169.254.169.254, or attempt SQL/SPARQL injection; fixed in 0.4.85.
workflow·prompt injection·
20 Mar 2026 · Anthropic
Three vulnerabilities disclosed in March 2026 affect agentic AI tooling: Claude Code before 2.1.53 could be silently placed into bypassPermissions mode by a malicious repository's committed .claude/settings.json, skipping the workspace trust dialog; the Go MCP SDK before 1.4.1 accepted cross-site POST requests to its Streamable HTTP transport without Origin or Content-Type validation, potentially allowing any website to trigger tool execution on a local server; and the MCP Ruby SDK before 0.9.2 allowed session hijacking of SSE streams by anyone holding a valid session ID. All three were patched.
coding·excessive permissions·
20 Mar 2026 · labring
FastGPT versions 4.14.8.3 and below contain a vulnerable fastgpt-preview-image.yml GitHub Actions workflow that uses pull_request_target while checking out and building code from a pull request author's fork, allowing any external contributor to execute arbitrary code, exfiltrate repository secrets, and push malicious images to the production container registry. No patch was available at publication.
workflow·supply chain·
20 Mar 2026 · PinchTab
Six CVEs were published against PinchTab, a standalone HTTP server that gives AI agents direct control over a Chrome browser, covering blind SSRF in the /download endpoint and the scheduler webhook path, API tokens accepted in URL query strings, unwired rate limiting, a JavaScript evaluation policy bypass via /wait fn mode, and a Windows-only PowerShell command injection in Chrome cleanup. Most issues were fixed in versions 0.8.3 through 0.8.5, while the /wait evaluation bypass had no patched release at time of publication.
browsing·tool misuse·
20 Mar 2026 · doobidoo
Versions of the open-source mcp-memory-service memory backend prior to 10.25.1 configured FastAPI CORSMiddleware with allow_origins='*' and allow_credentials=True when the HTTP server was enabled, letting any website read API responses cross-origin. Combined with anonymous access, any malicious site could silently read, modify, and delete all stored memories; fixed in 10.25.1.
other·misconfiguration·
19 Mar 2026 · Meta
The Verge reported that a rogue AI agent led to a serious security incident at Meta. No further details about the nature, scope or impact of the incident are available in the provided source.
other·unknown·
19 Mar 2026 · Microsoft
Two CVEs (CVE-2026-24299 and CVE-2026-26136) describe improper neutralization of special elements used in a command in M365 Copilot and Microsoft Copilot, allowing an unauthorized attacker to disclose information over a network. Microsoft published advisories for both issues via MSRC.
other·unknown·
19 Mar 2026 · Discourse
Discourse versions before 2026.3.0-latest.1, 2026.2.1 and 2026.1.2 rendered raw LLM output with htmlSafe in the Review Queue, so an attacker could use prompt injection to make the AI return a malicious payload that executed when staff viewed a flagged post. Patched releases are available, with disabling AI triage automation scripts as a workaround.
workflow·prompt injection·
19 Mar 2026 · DataEase
SQLBot versions 1.5.0 and below contain a stored prompt injection vulnerability chaining a missing permission check on the Excel upload API, unsanitized terminology storage, and no semantic fencing of terminology injected into the LLM system prompt. An authenticated attacker could hijack the LLM's reasoning to emit malicious PostgreSQL commands such as COPY ... TO PROGRAM, achieving remote code execution with postgres privileges; fixed in v1.6.0.
other·prompt injection·
16 Mar 2026 · Mintplex Labs
Two vulnerabilities were disclosed in Mintplex Labs' AnythingLLM (versions 1.11.1 and earlier): default installations without a password or API key leave all HTTP endpoints and the agent WebSocket unauthenticated with a permissive CORS policy (CVE-2026-32617), and the built-in SQL Agent plugin builds queries by string concatenation, letting any user who can invoke the agent run arbitrary SQL on connected MySQL, PostgreSQL or MSSQL databases (CVE-2026-32628).
workflow·tool misuse·
16 Mar 2026 · AWS
A flaw in the no-access and workdir features of the AWS API MCP Server (versions >= 0.2.14 and < 1.3.9) allowed intended file access restrictions to be bypassed, exposing arbitrary local file contents in the MCP client application context. AWS published a security bulletin and fixed the issue in version 1.3.9.
other·excessive permissions·
16 Mar 2026 · PrefectHQ
FastMCP versions prior to 2.14.2 did not respect the resource parameter submitted by clients in authorization and token requests, issuing tokens for the base_url given to the OAuthProxy rather than explicitly for the MCP server. The issue was patched in version 2.14.2.
other·excessive permissions·
12 Mar 2026 · getzep
Graphiti versions before 0.28.2 concatenated attacker-controlled label values from SearchFilters.node_labels directly into Cypher expressions, enabling Cypher injection on Neo4j, FalkorDB and Neptune backends. In MCP deployments it could be triggered by prompt injection against an LLM client induced to call search_nodes with attacker-controlled entity_types; fixed in 0.28.2.
other·prompt injection·
11 Mar 2026 · Cursor
A vulnerability in the Cursor AI code editor prior to version 2.0 allowed maliciously crafted instructions on visited websites to be followed by the model, and combined with a command whitelist bypass, could cause commands to run automatically without user intent. The issue is fixed in Cursor 2.0.
coding·prompt injection·
11 Mar 2026 · homeassistant-ai
Versions of the ha-mcp Home Assistant MCP server prior to 7.0.0 contained two vulnerabilities in the beta OAuth consent flow: an unvalidated user-supplied ha_url enabling unauthenticated server-side request forgery for internal network reconnaissance (CVE-2026-32111), and unescaped user-controlled parameters rendered via Python f-strings enabling JavaScript execution in the operator's browser (CVE-2026-32112). Both were fixed in release 7.0.0.
workflow·unknown·
11 Mar 2026 · FastGPT (labring)
FastGPT's Python Sandbox (fastgpt-sandbox) in version 4.14.7 and earlier contains guardrails (static detection plus seccomp) intended to block file writes, but they can be bypassed by remapping stdout (fd 1) to another writable file descriptor with fcntl. Writes via sys.stdout.write() then still satisfy the seccomp rule for write(fd==1), allowing arbitrary file creation or overwrite inside the sandbox container.
coding·misconfiguration·
10 Mar 2026 · Microsoft
Microsoft published two CVEs affecting its AI agent infrastructure: CVE-2026-26133, an AI command injection flaw in M365 Copilot that lets an unauthorized attacker disclose information over a network, and CVE-2026-26118, a server-side request forgery flaw in Azure MCP Server that lets an authorized attacker elevate privileges over a network.
workflow·prompt injection·
10 Mar 2026 · sooperset
Two vulnerabilities (CVE-2026-27826 and CVE-2026-27825) in the MCP Atlassian Model Context Protocol server allowed unauthenticated attackers to force outbound requests to arbitrary URLs via HTTP middleware, and allowed the confluence_download_attachment tool to write attacker-controlled content to arbitrary paths, enabling code execution. Both are fixed in version 0.17.0.
workflow·tool misuse·
7 Mar 2026 · doobidoo
Versions of the open-source mcp-memory-service memory backend prior to 10.21.0 returned detailed system information (OS and Python versions, CPU count, memory, disk usage and database filesystem path) from the /api/health/detailed endpoint without authentication when anonymous access was enabled, exposing reconnaissance data to the network due to the default 0.0.0.0 binding. The issue was patched in version 10.21.0.
other·misconfiguration·
7 Mar 2026 · PinchTab
A Server-Side Request Forgery vulnerability in the /download endpoint of PinchTab, an HTTP server that gives AI agents direct control over Chrome, allowed any user with API access to make the server request arbitrary URLs, including internal network services and local files, and exfiltrate the responses. The issue was patched in version 0.7.7.
browsing·excessive permissions·
7 Mar 2026 · Tencent
A vulnerability in Tencent's WeKnora LLM document-understanding framework before version 0.3.0 let a malicious remote MCP server register a tool that overwrites a legitimate one due to an ambiguous mcp_{service}_{tool} naming convention. Combined with indirect prompt injection, this allowed attackers to hijack LLM execution flow, exfiltrate system prompts and context, and run other tools with the user's privileges.
workflow·prompt injection·
6 Mar 2026 · GitHub
GitHub Copilot CLI versions up to and including 0.0.422 contained a flaw where crafted bash parameter expansion patterns could hide executable code inside commands classified as read-only by the safety layer, enabling arbitrary code execution on a user's workstation via prompt injection through repository files, MCP server responses or user instructions. The issue was patched in version 0.0.423.
coding·prompt injection·
6 Mar 2026 · Agentgateway
Agentgateway, an open source data plane for agentic AI connectivity, failed to sanitize path, query, and header values when converting MCP tools/call requests into OpenAPI requests in versions prior to 0.12.0. The issue was patched in version 0.12.0.
other·tool misuse·
5 Mar 2026 · Aqua Security
Version 1.8.12 of the Trivy Vulnerability Scanner VS Code extension distributed through the OpenVSX marketplace was compromised and contained malicious code that used the local AI coding agent to collect and exfiltrate sensitive information. The malicious artifact has been removed from the marketplace and users are advised to remove it and rotate environment secrets.
coding·supply chain·
5 Mar 2026 · OpenClaw
Two vulnerabilities were disclosed in the OpenClaw agent platform: an SSRF issue in the Feishu extension (CVE-2026-28451) that lets attackers trigger fetches of attacker-controlled or internal URLs via tool calls influenced by prompt injection, and a remote code execution flaw (CVE-2026-30741) in v2026.2.6 exploitable through request-side prompt injection.
other·prompt injection·
3 Mar 2026 ·
A buffer overflow vulnerability was reported in LLM-Claw versions 0.1.0 through 0.1.1a-p1, in the agent_deploy_init function of /agents/deploy/initiate.c in the Agent Deployment component. The flaw can be exploited remotely, and a patch is available to remediate it.
other·unknown·
2 Mar 2026 · ModelScope
A command injection vulnerability in ModelScope's ms-agent (versions v1.6.0rc1 and earlier) allows an attacker to execute arbitrary operating system commands through crafted prompt-derived input. A proof-of-concept and write-up describing escalation from AI prompt to full system compromise were published alongside the CVE.
other·prompt injection·
