AI agents

The Bread & Butter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 7.10.1321. Missing or incorrect nonce validation in the uploadImage() function lets unauthenticated attackers upload arbitrary files, which can enable remote code execution if they trick a site administrator into clicking a link.

CVE-2025-62612 affects FastGPT, an AI Agent building platform, prior to version 4.11.1. The workflow file reading node does not verify network links for security, which exposes the platform to server-side request forgery (SSRF, CWE-918). The source rates the issue MEDIUM under CVSS 4.0 (GitHub, Inc., base score 6.9).

Modern AI agents run system commands such as find, grep, rg and git without human approval for efficiency, and the researchers describe bypassing human approval through argument injection against these pre-approved commands. They achieved remote code execution with a single prompt against three unnamed production agent platforms, which the authors say remain under coordinated disclosure.

Mastra, a TypeScript framework for building AI agents and assistants, is vulnerable in versions 0.13.8 through 0.13.20-alpha.0 to directory traversal. A path traversal check that protects reading file contents is bypassed by later logic that generates directory suggestions, letting an attacker list arbitrary directories on the user's filesystem, including the home directory, and expose details of the file system's structure.

Claude Code versions below 1.0.120 did not account for symlinks when checking permission deny rules. If a user denied Claude Code access to a file, but Claude Code could reach a symlink pointing to that file, Claude Code could still access the file.

Johann Rehberger describes a design flaw in agentic systems that lets one coding agent rewrite another agent's configuration, freeing it from its sandbox. In his demo, a prompt-injected GitHub Copilot writes a malicious MCP server into Claude Code's config, which then runs arbitrary code. The post notes that Claude can reciprocate by modifying Copilot's configuration.

Roo Code versions 3.25.23 and below contain a flaw where .rooignore exclusions can be bypassed using symlinks. An attacker with write access to the workspace can trick the extension into reading files meant to be excluded, such as .env or configuration files, exposing secrets and other excluded project data.