AI agents

Pydantic AI versions 2.10.0 through 2.53.0 have a flaw in streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency. Because anyio.CapacityLimiter ties an acquired slot to the borrowing task while streaming cleanup can run in a different task, early termination, cancellation, consumer exceptions, or complete stream_text() consumption with debounce_by=0.1 can leave shared concurrency slots occupied. Later requests on the long-lived limiter can then be blocked, causing a denial of service. Agent-level max_concurrency and non-streaming model requests are not affected.

CVE-2026-82627 affects The Uncanny Automator AI + Automation plugin for WordPress in all versions up to and including 7.6.1.1. The flaw is PHP Object Injection via deserialization of untrusted input, which lets an authenticated user with Subscriber-level access or higher inject a PHP object when a third-party integration plugin such as PeepSo, MailPoet or WPForms is installed and a recipe stores attacker-controlled data as trigger meta. A POP chain within Uncanny Automator allows the attacker to delete arbitrary files on the server.

Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool. Any MCP client that can call smart_user can run arbitrary shell commands through the username argument of the get-user-info operation, with the privileges of the user running the server.

Zammad, a web-based open source helpdesk and customer support system, has a flaw before version 7.1.2. A security filter protecting its AI Agent configuration can be bypassed by entering specially crafted text into an AI Agent field. An administrator with permission to create or edit AI Agents could run arbitrary commands on the host server, potentially reading, modifying, or destroying all stored data. No action from other users is required, since the malicious code executes the next time the affected AI Agent processes a ticket.

CVE-2026-95985 affects the file write tool in Kiro IDE, an agentic desktop IDE, before version 1.0.242. The flaw may let remote unauthenticated actors execute arbitrary commands and inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository opened as an untrusted workspace, sending any message can cause the agent to modify auto-loaded global configuration paths.

CVE-2026-61687 affects Hatchet, a platform for orchestrating background tasks, AI agents, and durable workflows, in versions prior to 0.91.1. ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback, then accepts an empty state parameter as equal, letting an unauthenticated attacker bind a victim's session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and auth.google.enabled, auth.github.enabled, or the Slack integration to be enabled.

AI Agent Automation, a modular AI agent workflow platform, is affected by CVE-2026-54520 in versions prior to 0.9.1. The executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd() and uses the result for reads or writes without confirming it stays inside an approved workflow directory. An authenticated user who can create or modify workflow file steps can use traversal segments to read sensitive files or write and overwrite files the backend process can access, including application-adjacent files when process permissions allow.

AI Agent Automation versions prior to 0.9.1 contain an authorization flaw in backend/src/controllers/memory.controller.js. The listMemories, deleteMemory, and clearAgentMemory functions accept a caller-supplied agentId or memory _id without checking that the related Agent belongs to req.user. An authenticated attacker who knows or obtains another user's identifiers can read that user's AgentMemory content, delete an individual memory, or clear all memory for a victim agent.

MCP Documentation Server versions 1.13.0 through 1.13.1 start a Web UI by default on port 3080, and startWebServer in src/web-server.ts calls app.listen(PORT) without a host, binding the unauthenticated document-management API to all interfaces instead of localhost. A network-reachable client can call endpoints such as GET /api/documents, POST /api/documents, DELETE /api/documents/:id and POST /api/search-all without credentials to read, search, insert or delete documents and alter the assistant's knowledge base. The attacker must be able to reach the service over a LAN, VM network, container bridge, VPN or other routed network, and the issue does not grant remote code execution.

CodeRAG versions prior to 1.3.1 execute repository-controlled code during the default agent-coderag sync flow. When build.gradle or build.gradle.kts is present, _sync_gradle runs a repository-supplied gradlew or gradlew.bat via asyncio.create_subprocess_exec, and validate_path checks only the directory, not the executable's content or integrity. Indexing an attacker-controlled Gradle repository therefore runs attacker code with the victim's operating-system privileges, enabling disclosure, modification, persistence, or denial of service.

A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, which is distributed exclusively in the Chinese market. A local user who opens a specially crafted link handled by the application could allow operating system commands to be executed.