Advisories

Claude Agent SDK for Python, prior to 0.2.121, passes the resume option to the Claude CLI as a separate token without validation. A dash-leading value is parsed as an independent CLI flag, so an attacker can inject --mcp-config to define a stdio MCP server and execute arbitrary commands at CLI startup, outside SDK permission controls. Exploitation requires an application that passes untrusted input as the session ID to resume.

Tandoor Recipes versions prior to 2.6.10 pass an administrator-controlled AI provider URL to LiteLLM without the server's SSRF checks. An authenticated user who configures a provider URL pointing at an internal address and then invokes an AI action (via cookbook/views/api.py, endpoints api/ai-import/ and api/ai-step-sort/) can use the server as a blind network-reachability oracle, reaching internal services and cloud metadata endpoints and mapping internal hosts and ports.

destructive_command_guard (dcg), a command-line tool that blocks destructive shell commands before AI coding agents run them, is affected in versions prior to 0.6.6. Nested or unclosed $( and $(( substitutions cause the scanners reached through split_command_segments in src/packs/mod.rs to rescan the command suffix repeatedly, producing exponential-time work. A hung PreToolUse hook then fails open, letting a destructive command proceed.

Wheels CLI versions 4.0.0 through 4.1.1 insufficiently validate or escape caller-supplied values and package contents. Deploy release, version and rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds, and the flaw also enables file deletion, file overwrites, writes outside the project, and injected CFML in generated code. Unencoded display properties in generated scaffold show and admin views permit stored XSS, and stale process-ID handling in RustCFML server commands can terminate an unrelated process.

IntentKit through 2.6.3 has an authorization bypass in which the executor checks tool calls against the full tool registry instead of the per-request narrowed tool set enforced by ToolBindingMiddleware. This lets owner-only, state-changing tools such as wallet transfer, posting, memory-write and call-agent run without a human-in-the-loop or approval gate. An unauthenticated or public caller in the WEB, API, TWITTER or TELEGRAM contexts can exploit it by supplying the de-advertised tool name and arguments through indirect prompt injection, or by replaying checkpoint and history data on a reused thread.

Ludwig versions before 0.17.8 have a path traversal flaw in ludwig.datasets.archives.extract_archive(). The function checks tar member names but not symlink or hard-link members, and uses os.path.commonprefix for its containment check, so a crafted archive can write files to arbitrary paths with the extracting process's privileges. Exploitation requires a user to process an archive from an attacker-controlled or compromised source on Python 3.12 or 3.13; Python 3.14 is not affected.

Portkey AI Gateway versions 1.14.0 through 1.15.2 contain a server-side request forgery flaw tracked as CVE-2026-110719. Because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset, unauthenticated attackers can send /v1 requests with a crafted x-portkey-custom-host header, for example via the ollama provider, so the gateway calls loopback and Docker host services and returns their responses.

Prior to version 2.1.179, the Claude Code and Claude Desktop plugin installation flow ran git checkout for a marketplace-pinned commit without checking that the resulting HEAD matched the pinned 40-character SHA. An attacker controlling a plugin repository on a Git host that allows SHA-shaped branch names could create a branch named after the reviewed commit, so checkout selected the branch tip and installed attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the apparently safe hash.

Wukong AICRM through 20260610 has a missing authorization flaw that lets any authenticated user call user, role, department and agent administration APIs, since no administrator check exists. An attacker can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.

Roo Code through 3.54.0 contains a command approval bypass in parseCommandLine() that lets attackers auto-approve arbitrary shell commands. By placing a command substitution in command position, such as $(echo touch /tmp/x), an attacker using indirect prompt injection passes the echo allowlist check, and the shell executes the substituted output without user approval.

Roo Code through 3.54.0 has a command approval bypass in its parseCommandLine() function, which discards command substitutions placed next to * or ? glob characters. An attacker using indirect prompt injection can craft a command such as echo *$(...) that matches an allowlisted prefix, so a denied command runs without user approval when auto-approval is enabled.

Roo Code through 3.54.0 has a command approval bypass. Its parseCommandLine() function treats ${ command; } substitutions as parameter expansions, so attackers using indirect prompt injection can hide denied shell commands inside an allowlisted command such as echo. The commands run without user approval on bash 5.3+ or ksh93.