Latest
●Mem0 memory keys can be forged to read other tenants' chats●vLLM's wildcard CORS default let any website query local servers●Rust zip crate flaw lets archives hide a second filename●Microsoft says agents in Microsoft 365 grew 15-fold in a year●Attacker Poses as AI Crawlers to Hunt for Exposed Credentials●Functype MCP server flaw let tool calls run arbitrary code●Token Security says blast radius matters more than patch speed●OpenAI agent validated 14 leaked Hugging Face tokens
Thursday, 29 October 2026
0 agent hacks today▼ 6 vs yesterday (6)
The Agentic TimesPowered byVortal

Incident database

Neo.mjs command injection in FileSystemService.mjs

Neo.mjs contains command injection vulnerabilities in the FileSystemService.mjs component where checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled paths into shell commands, enabling arbitrary OS command execution when AI agents invoke these tools.

Disclosed 20 August 2026 · Record updated 1 October 2026

Impact

Arbitrary OS command execution when AI agents are induced to invoke vulnerable tools through unsanitized path parameters

Our coverage

No articles linked to this incident yet.

Sources

  1. nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-18482