AI agents

FastGPT versions 4.14.8.3 and below have a flaw in the fastgpt-preview-image.yml workflow. It uses pull_request_target, which runs with access to repository secrets, yet checks out code from the pull request author's fork, so any external contributor can achieve arbitrary code execution and secret exfiltration. The workflow also builds and pushes Docker images from attacker-controlled Dockerfiles, which enables a supply chain attack via the production container registry.

PinchTab, a standalone HTTP server that gives AI agents direct control over a Chrome browser, contains a Server-Side Request Forgery (SSRF) flaw in its /download endpoint in versions prior to 0.7.7 (CWE-918). Any user with API access can make the server request arbitrary URLs, including internal network services and local system files, and exfiltrate the full response content.

Pydantic AI, a Python agent framework for Generative AI applications, contains a Server-Side Request Forgery (SSRF) flaw in its URL download functionality in versions from 0.0.26 to before 1.56.0. When applications accept message history from untrusted sources, attackers can include malicious URLs that make the server send HTTP requests to internal network resources, potentially reaching internal services or cloud credentials. Only applications that accept message history from external users are affected.

Pydantic AI versions from 1.34.0 before 1.51.0 contain a path traversal flaw in the web UI. The version query parameter in the CDN URL is not validated, so a crafted URL makes the server fetch and serve attacker-controlled HTML/JavaScript from another location on the same CDN. Only applications using Agent.to_web or clai web are affected, and an attacker who lures a victim into clicking the link or loading it in an iframe can run code in the victim's browser and steal chat history and other client-side data.

Claude Code, an agentic coding tool, failed to strictly enforce deny rules set in settings.json when accessing files through symbolic links. A user's explicit denial of a file such as /etc/passwd could be bypassed by reading that file through a symlink pointing to it. The issue is tracked as CVE-2026-25724 and affects versions prior to 2.1.7.

CVE-2026-24887 affects Claude Code, an agentic coding tool, prior to version 2.0.72. A command parsing error let an attacker bypass the confirmation prompt and run untrusted commands through the find command. Exploitation reliably required the ability to add untrusted content into the Claude Code context window.

CVE-2026-24052 affects Claude Code before version 1.0.111. Its trusted domain check for WebFetch requests used startsWith(), so a domain such as modelcontextprotocol.io.example.com passed validation as if it were modelcontextprotocol.io. This could let an attacker trigger automatic requests to attacker-controlled domains without user consent, potentially leading to data exfiltration.