AI agents

CVE-2026-42075 affects Evolver, a GEP-powered self-evolving engine for AI agents, prior to version 1.69.3. A path traversal flaw (CWE-22) in the skill download (fetch) command accepts unvalidated paths through the --out= flag, allowing attackers to write files to arbitrary filesystem locations. The source says this can overwrite critical system files or create files in sensitive locations.

Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation flaw. Agents can update their own adapterConfig through the /agents/:id endpoint, and the server later executes adapterConfig.workspaceStrategy.provisionCommand during workspace provisioning. An attacker holding an Agent API key can inject shell commands that run on the Paperclip server host, which the source describes as remote code execution.

Claude Code versions before 2.1.64 let sandboxed processes create symlinks pointing outside the workspace. When Claude Code later wrote through such a symlink, its unsandboxed process followed it and wrote to the external target without asking the user for confirmation, enabling a sandbox escape that could potentially lead to code execution outside the sandbox. Exploitation required injecting untrusted content into the Claude Code context window to trigger sandboxed code execution.

FastGPT, an AI Agent building platform, has a NoSQL injection flaw in its password change endpoint in versions prior to 4.14.9.5. An authenticated attacker can inject MongoDB query operators to bypass the "old password" check, changing the password of their own account or others' accounts when combined with ID manipulation, which leads to full account takeover and persistence.

CVE-2026-39981 affects AGiXT, an AI Agent Automation Platform, before version 1.9.2. The safe_join() function in the essential_abilities extension does not check that resolved file paths stay within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance.

OpenClaw's openclaw npm package, versions <=2026.3.24, lets an LLM agent silently disable exec approval through the config.patch function, bypassing user consent for command execution. Maintainers fixed it in commit 76411b2afc4ae721e36c12e0ea24fd23e2fed61e, shipped in v2026.3.28, and rate the issue high severity.

FastGPT, an AI Agent building platform, has an SSRF flaw in its MCP tools endpoints, /api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool, before version 4.14.9.5. These endpoints accept a user-supplied URL and send server-side HTTP requests to it without checking for internal or private network addresses. The application's isInternalAddress() function exists but these endpoints do not call it. An authenticated attacker can scan internal networks, reach cloud metadata services, and interact with internal services such as MongoDB and Redis.

PinchTab v0.8.3 through v0.8.5 let a caller with the server token run arbitrary JavaScript in a tab through POST /wait and POST /tabs/{id}/wait when fn mode is used, even with security.allowEvaluate disabled. POST /evaluate enforces that guard, but /wait embedded the user-supplied fn expression into executable JavaScript without checking it. The flaw is a policy bypass rather than an authentication bypass, since authenticated API access is still required.