{ "updated": "2026-11-04", "section": "security", "ghsa_fetched": "2026-11-04", "ghsa_repos": { "anthropics/claude-code": 36, "anthropics/claude-desktop": 0, "cursor/cursor": 33, "openai/codex": 1, "google-gemini/gemini-cli": 0, "cline/cline": 3, "RooCodeInc/Roo-Code": 11, "zed-industries/zed": 12, "continuedev/continue": 0, "aaif-goose/goose": 1, "kirodotdev/Kiro": 0, "microsoft/vscode": 65, "github/github-mcp-server": 2, "aws/aws-toolkit-vscode": 2, "modelcontextprotocol/typescript-sdk": 10, "modelcontextprotocol/python-sdk": 12, "modelcontextprotocol/go-sdk": 4, "modelcontextprotocol/csharp-sdk": 1, "modelcontextprotocol/java-sdk": 7, "modelcontextprotocol/inspector": 14, "modelcontextprotocol/servers": 15, "geelen/mcp-remote": 0, "npm:@google/gemini-cli": 1, "npm:@openai/codex": 1, "npm:@anthropic-ai/claude-code": 0, "npm:mcp-remote": 1, "npm:@modelcontextprotocol/sdk": 1, "npm:@modelcontextprotocol/inspector": 0, "npm:@modelcontextprotocol/server-filesystem": 0, "pip:mcp": 0, "npm:cline": 0 }, "features": [ { "id": "approval", "name": "Tool-call approval prompts", "desc": "Asks the user before running tools, shell commands or MCP calls by default" }, { "id": "allowdeny", "name": "Per-tool allow / deny", "desc": "Rules that pre-approve or block specific tools, commands or MCP tools" }, { "id": "sandbox", "name": "Sandboxing", "desc": "OS-level or container isolation for agent commands" }, { "id": "oauth", "name": "OAuth for remote MCP", "desc": "OAuth sign-in to remote MCP servers instead of pasted tokens" }, { "id": "signed", "name": "Verified marketplace listings", "desc": "Vendor review, signing or verification of plugins, extensions or MCP listings" }, { "id": "autoupdate", "name": "Auto-install / auto-update control", "desc": "Documented behaviour and controls for automatic plugin/extension installs and updates" }, { "id": "admin", "name": "Admin allowlists", "desc": "Org admins can restrict which MCP servers, plugins or connectors are allowed" }, { "id": "audit", "name": "Audit logs", "desc": "Admin-visible audit log or compliance export of agent / integration activity" }, { "id": "training", "name": "Data retention / training opt-out", "desc": "Documented control over training use and retention" }, { "id": "disclosure", "name": "Security disclosure page", "desc": "Public vulnerability disclosure channel or published advisories" } ], "clients": [ { "id": "claude-code", "tool": "claude-code", "name": "Claude Code", "vendor": "Anthropic", "url": "https://code.claude.com/docs/en/security", "cells": { "approval": { "status": "yes", "source": "https://code.claude.com/docs/en/permissions", "note": "Read-only by default; asks before Bash, file edits and MCP tools", "checked": "2026-11-04" }, "allowdeny": { "status": "yes", "source": "https://code.claude.com/docs/en/permissions", "note": "allow / ask / deny rules, incl. mcp__server__tool patterns", "checked": "2026-11-04" }, "sandbox": { "status": "yes", "source": "https://code.claude.com/docs/en/sandboxing", "note": "OS-level sandbox for Bash: Seatbelt on macOS, bubblewrap on Linux/WSL2", "checked": "2026-11-04" }, "oauth": { "status": "yes", "source": "https://code.claude.com/docs/en/mcp", "note": "OAuth 2.0 for remote HTTP servers; project .mcp.json servers need approval", "checked": "2026-11-04" }, "signed": { "status": "no", "source": "https://code.claude.com/docs/en/plugins/security", "note": "Anthropic says it cannot verify what third-party plugins contain or that they won't change", "checked": "2026-11-04" }, "autoupdate": { "status": "partial", "source": "https://code.claude.com/docs/en/plugins/install", "note": "Plugins update in the background when a marketplace has auto-update on; toggle per marketplace", "checked": "2026-11-04" }, "admin": { "status": "yes", "source": "https://code.claude.com/docs/en/managed-mcp", "note": "Managed settings: MCP allowlists and denylists", "checked": "2026-11-04" }, "audit": { "status": "partial", "source": "https://code.claude.com/docs/en/monitoring-usage", "note": "OpenTelemetry export of tool decisions and usage; no built-in audit log page", "checked": "2026-11-04" }, "training": { "status": "yes", "source": "https://code.claude.com/docs/en/data-usage", "note": "Consumer training choice; commercial terms exclude training; ZDR for eligible orgs", "checked": "2026-11-04" }, "disclosure": { "status": "yes", "source": "https://code.claude.com/docs/en/security", "note": "HackerOne program; 36 GHSAs published on anthropics/claude-code", "checked": "2026-11-04" } } }, { "id": "claude", "tool": "claude", "name": "Claude apps (claude.ai / Desktop)", "vendor": "Anthropic", "url": "https://support.claude.com", "cells": { "approval": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "allowdeny": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "sandbox": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "oauth": { "status": "yes", "source": "https://support.claude.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp", "note": "Custom connectors: recommended client, automatic registration or your own OAuth client", "checked": "2026-11-04" }, "signed": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "autoupdate": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "admin": { "status": "yes", "source": "https://support.claude.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp", "note": "On Team/Enterprise only Owners can add custom connectors", "checked": "2026-11-04" }, "audit": { "status": "yes", "source": "https://support.claude.com/en/articles/9970975-how-to-access-audit-logs", "note": "Audit log export for Team and Enterprise", "checked": "2026-11-04" }, "training": { "status": "yes", "source": "https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training", "note": "Consumer accounts choose whether chats train models; commercial data excluded", "checked": "2026-11-04" }, "disclosure": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" } } }, { "id": "chatgpt", "tool": "chatgpt", "name": "ChatGPT (apps & connectors)", "vendor": "OpenAI", "url": "https://chatgpt.com", "cells": { "approval": { "status": "unknown", "source": null, "note": "help.openai.com blocks automated fetches; not verified", "checked": "2026-11-04" }, "allowdeny": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "sandbox": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "oauth": { "status": "yes", "source": "https://pournasserian.com/writing/mcp-2026-host-support", "note": "Secondary source (carried from the /mcp matrix)", "checked": "2026-11-04" }, "signed": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "autoupdate": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "admin": { "status": "yes", "source": "https://learn.chatgpt.com/docs/enterprise/apps-and-connectors", "note": "Workspace admins control which apps and plugins members can install", "checked": "2026-11-04" }, "audit": { "status": "yes", "source": "https://learn.chatgpt.com/docs/enterprise/compliance-api", "note": "Compliance API with audit events for Enterprise", "checked": "2026-11-04" }, "training": { "status": "unknown", "source": null, "note": "help.openai.com blocks automated fetches; not verified", "checked": "2026-11-04" }, "disclosure": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" } } }, { "id": "codex", "tool": "codex", "name": "Codex", "vendor": "OpenAI", "url": "https://developers.openai.com/codex/security", "cells": { "approval": { "status": "yes", "source": "https://learn.chatgpt.com/docs/agent-approvals-security", "note": "Approval policy (e.g. on-request); the untrusted policy was retired", "checked": "2026-11-04" }, "allowdeny": { "status": "yes", "source": "https://developers.openai.com/codex/mcp", "note": "Per-server enabled_tools / disabled_tools and default_tools_approval_mode", "checked": "2026-11-04" }, "sandbox": { "status": "yes", "source": "https://learn.chatgpt.com/docs/agent-approvals-security", "note": "OS-enforced sandbox (read-only / workspace-write); network off by default", "checked": "2026-11-04" }, "oauth": { "status": "yes", "source": "https://developers.openai.com/codex/mcp", "note": "OAuth incl. CIMD and dynamic client registration", "checked": "2026-11-04" }, "signed": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "autoupdate": { "status": "unknown", "source": null, "note": "Postman's installer wrote a trusted hook hash into Codex config (see advisories)", "checked": "2026-11-04" }, "admin": { "status": "yes", "source": "https://learn.chatgpt.com/docs/enterprise/managed-configuration", "note": "Managed config can pin an MCP allowlist (name + identity must match)", "checked": "2026-11-04" }, "audit": { "status": "yes", "source": "https://learn.chatgpt.com/docs/enterprise/compliance-api", "note": "Compliance API audit events", "checked": "2026-11-04" }, "training": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "disclosure": { "status": "yes", "source": "https://github.com/openai/codex/security/advisories", "note": "Advisories published on openai/codex", "checked": "2026-11-04" } } }, { "id": "cursor", "tool": "cursor", "name": "Cursor", "vendor": "Anysphere", "url": "https://cursor.com/security", "cells": { "approval": { "status": "yes", "source": "https://cursor.com/docs/agent/security/run-modes", "note": "Run modes; Auto-review runs allowlisted calls, sandboxes shell commands, sends the rest to a classifier", "checked": "2026-11-04" }, "allowdeny": { "status": "yes", "source": "https://cursor.com/docs/agent/security/run-modes", "note": "Allowlisted commands and tools run without review", "checked": "2026-11-04" }, "sandbox": { "status": "yes", "source": "https://cursor.com/docs/agent/security/run-modes", "note": "Shell commands run in a sandbox when possible (Auto-review / Allowlist)", "checked": "2026-11-04" }, "oauth": { "status": "yes", "source": "https://cursor.com/docs/mcp", "note": "OAuth for SSE / Streamable HTTP servers", "checked": "2026-11-04" }, "signed": { "status": "partial", "source": "https://cursor.com/docs/enterprise/security-hardening", "note": "Optional extension signature verification for admins", "checked": "2026-11-04" }, "autoupdate": { "status": "partial", "source": "https://cursor.com/docs/enterprise/security-hardening", "note": "Extension allowlist and install cooldown for admins", "checked": "2026-11-04" }, "admin": { "status": "yes", "source": "https://cursor.com/docs/enterprise/model-and-integration-management", "note": "Enterprise MCP allowlist (command / URL entries)", "checked": "2026-11-04" }, "audit": { "status": "yes", "source": "https://cursor.com/docs/enterprise/compliance-and-monitoring", "note": "Audit logs for Enterprise", "checked": "2026-11-04" }, "training": { "status": "yes", "source": "https://cursor.com/docs/enterprise/privacy-and-data-governance", "note": "Privacy Mode: no training; on by default for Enterprise", "checked": "2026-11-04" }, "disclosure": { "status": "yes", "source": "https://github.com/cursor/cursor/security/advisories", "note": "33 GHSAs published on cursor/cursor", "checked": "2026-11-04" } } }, { "id": "copilot", "tool": "copilot", "name": "GitHub Copilot (VS Code)", "vendor": "GitHub / Microsoft", "url": "https://code.visualstudio.com/docs/copilot/security", "cells": { "approval": { "status": "yes", "source": "https://code.visualstudio.com/docs/copilot/security", "note": "Tool and terminal approvals; auto-approve and Autopilot are opt-in", "checked": "2026-11-04" }, "allowdeny": { "status": "partial", "source": "https://code.visualstudio.com/docs/copilot/security", "note": "Auto-approve settings and edit globs; per-tool page returned 404", "checked": "2026-11-04" }, "sandbox": { "status": "partial", "source": "https://code.visualstudio.com/docs/copilot/security", "note": "Docs reference agent sandboxing and workspace trust", "checked": "2026-11-04" }, "oauth": { "status": "partial", "source": "https://mcpstepbystep.com/learn/mcp-client-support/", "note": "Static oauth.clientId; DCR/CIMD unconfirmed (from /mcp matrix)", "checked": "2026-11-04" }, "signed": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "autoupdate": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "admin": { "status": "partial", "source": "https://docs.github.com/en/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-mcp-server-access", "note": "Org MCP registry restriction (public preview, Business / Enterprise)", "checked": "2026-11-04" }, "audit": { "status": "yes", "source": "https://docs.github.com/en/copilot/how-tos/administer-copilot/manage-for-enterprise/review-audit-logs", "note": "Copilot events in enterprise audit log", "checked": "2026-11-04" }, "training": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "disclosure": { "status": "yes", "source": "https://github.com/microsoft/vscode/security/advisories", "note": "Advisories published on microsoft/vscode and github/github-mcp-server", "checked": "2026-11-04" } } }, { "id": "windsurf", "tool": "windsurf", "name": "Windsurf / Devin Desktop", "vendor": "Cognition", "url": "https://windsurf.com/security", "cells": { "approval": { "status": "yes", "source": "https://docs.windsurf.com/windsurf/cascade/mcp", "note": "Prompts before any MCP tool call by default", "checked": "2026-11-04" }, "allowdeny": { "status": "yes", "source": "https://docs.windsurf.com/windsurf/terminal", "note": "Terminal allow / deny rules; per-tool MCP approval", "checked": "2026-11-04" }, "sandbox": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "oauth": { "status": "yes", "source": "https://docs.windsurf.com/windsurf/cascade/mcp", "note": "OAuth supported for remote servers", "checked": "2026-11-04" }, "signed": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "autoupdate": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "admin": { "status": "yes", "source": "https://docs.windsurf.com/windsurf/cascade/mcp", "note": "Admin MCP allowlist and private registries", "checked": "2026-11-04" }, "audit": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "training": { "status": "yes", "source": "https://windsurf.com/security", "note": "Opt-out means no training plus zero data retention; admin-enforced on Teams", "checked": "2026-11-04" }, "disclosure": { "status": "yes", "source": "https://windsurf.com/security", "note": "Vulnerability disclosure via security@cognition.ai", "checked": "2026-11-04" } } }, { "id": "gemini-cli", "tool": "gemini", "name": "Gemini CLI", "vendor": "Google", "url": "https://geminicli.com/docs", "cells": { "approval": { "status": "yes", "source": "https://geminicli.com/docs/tools/mcp-server", "note": "Confirmations on by default; per-server trust:true bypasses them", "checked": "2026-11-04" }, "allowdeny": { "status": "yes", "source": "https://geminicli.com/docs/tools/mcp-server", "note": "includeTools / excludeTools per server", "checked": "2026-11-04" }, "sandbox": { "status": "partial", "source": "https://geminicli.com/docs/cli/sandbox", "note": "Opt-in sandbox via -s or GEMINI_SANDBOX", "checked": "2026-11-04" }, "oauth": { "status": "yes", "source": "https://geminicli.com/docs/tools/mcp-server", "note": "OAuth incl. DCR", "checked": "2026-11-04" }, "signed": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "autoupdate": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "admin": { "status": "partial", "source": "https://geminicli.com/docs/cli/enterprise", "note": "System settings file overrides user settings", "checked": "2026-11-04" }, "audit": { "status": "partial", "source": "https://geminicli.com/docs/cli/enterprise", "note": "Telemetry export for auditing", "checked": "2026-11-04" }, "training": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "disclosure": { "status": "unknown", "source": null, "note": "No repo advisories; one GHSA exists in the global database", "checked": "2026-11-04" } } }, { "id": "kiro", "tool": "kiro", "name": "Kiro", "vendor": "AWS", "url": "https://kiro.dev/docs/privacy-and-security", "cells": { "approval": { "status": "yes", "source": "https://kiro.dev/docs/mcp/security", "note": "MCP tools need approval unless listed in autoApprove", "checked": "2026-11-04" }, "allowdeny": { "status": "yes", "source": "https://kiro.dev/docs/mcp/configuration", "note": "autoApprove and disabledTools per server", "checked": "2026-11-04" }, "sandbox": { "status": "partial", "source": "https://kiro.dev/docs/enterprise/governance", "note": "Docs list a Local command sandbox feature; details not reviewed", "checked": "2026-11-04" }, "oauth": { "status": "yes", "source": "https://mcpstepbystep.com/learn/mcp-client-support/", "note": "DCR default; CIMD (from /mcp matrix)", "checked": "2026-11-04" }, "signed": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "autoupdate": { "status": "partial", "source": "https://kiro.dev/docs/enterprise/governance", "note": "Enterprise docs include a Managed updates page", "checked": "2026-11-04" }, "admin": { "status": "yes", "source": "https://kiro.dev/docs/enterprise/governance", "note": "Disable MCP or allow-list vetted servers via an MCP registry", "checked": "2026-11-04" }, "audit": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "training": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "disclosure": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" } } }, { "id": "zed", "tool": "zed", "name": "Zed", "vendor": "Zed Industries", "url": "https://zed.dev/docs/ai/privacy-and-security", "cells": { "approval": { "status": "yes", "source": "https://zed.dev/docs/ai/tool-permissions", "note": "Tool actions confirm by default (always-allow defaults to off)", "checked": "2026-11-04" }, "allowdeny": { "status": "yes", "source": "https://zed.dev/docs/ai/tool-permissions", "note": "Per-tool rules incl. mcp::", "checked": "2026-11-04" }, "sandbox": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "oauth": { "status": "yes", "source": "https://zed.dev/docs/ai/mcp", "note": "Standard MCP OAuth flow", "checked": "2026-11-04" }, "signed": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "autoupdate": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "admin": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "audit": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "training": { "status": "yes", "source": "https://zed.dev/docs/ai/privacy-and-security", "note": "No prompt / code retention by default; no-training commitments", "checked": "2026-11-04" }, "disclosure": { "status": "yes", "source": "https://github.com/zed-industries/zed/security/advisories", "note": "12 GHSAs published on zed-industries/zed", "checked": "2026-11-04" } } }, { "id": "cline", "tool": "cline", "name": "Cline", "vendor": "Cline", "url": "https://docs.cline.bot", "cells": { "approval": { "status": "yes", "source": "https://docs.cline.bot/features/auto-approve", "note": "Asks before actions unless Auto-approve / YOLO is enabled", "checked": "2026-11-04" }, "allowdeny": { "status": "partial", "source": "https://docs.cline.bot/features/auto-approve", "note": "Auto-approve per action category, incl. MCP", "checked": "2026-11-04" }, "sandbox": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "oauth": { "status": "yes", "source": "https://docs.cline.bot/mcp/mcp-overview", "note": "Browser authorization for remote servers", "checked": "2026-11-04" }, "signed": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "autoupdate": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "admin": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "audit": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "training": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "disclosure": { "status": "yes", "source": "https://github.com/cline/cline/security/advisories", "note": "Advisories published on cline/cline", "checked": "2026-11-04" } } }, { "id": "jetbrains-ai", "tool": "jetbrains-ai", "name": "JetBrains AI", "vendor": "JetBrains", "url": "https://www.jetbrains.com/help/ai-assistant/", "cells": { "approval": { "status": "partial", "source": "https://www.jetbrains.com/help/ai-assistant/mcp.html", "note": "IDE MCP server confirms commands from external clients unless brave mode is on", "checked": "2026-11-04" }, "allowdeny": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "sandbox": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "oauth": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "signed": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "autoupdate": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "admin": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "audit": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" }, "training": { "status": "unknown", "source": null, "note": "Data-collection policy page returned 404", "checked": "2026-11-04" }, "disclosure": { "status": "unknown", "source": null, "note": "Not found in official docs checked 2026-11-04", "checked": "2026-11-04" } } } ], "advisories": [ { "id": "GHSA-rwv7-mh2c-ff2p", "cve": null, "date": "2026-11-05", "updated": "2026-11-05", "title": "Unvalidated runtimeArguments and identifier in server.json import & unvalidated URL scheme in web ElicitationUrlModalBody", "severity": "medium", "cvss": null, "tools": [ "mcp-protocol" ], "component": "MCP Inspector", "kind": "ghsa", "repo": "modelcontextprotocol/inspector", "affected": ">= 2.0.0, <= 2.13.0", "patched": "2.14.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-rwv7-mh2c-ff2p" ], "text": "Unvalidated runtimeArguments and identifier in server.json import & unvalidated URL scheme in web ElicitationUrlModalBody" }, { "id": "GHSA-h9j8-vj8g-v3gg", "cve": null, "date": "2026-11-05", "updated": "2026-11-05", "title": "MCP App escapes its CSP by navigating its own frame", "severity": "medium", "cvss": 6.1, "tools": [ "mcp-protocol" ], "component": "MCP Inspector", "kind": "ghsa", "repo": "modelcontextprotocol/inspector", "affected": ">= 2.0.0, <= 2.13.0", "patched": "2.14.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-h9j8-vj8g-v3gg" ], "text": "MCP App escapes its CSP by navigating its own frame" }, { "id": "GHSA-2fw8-7jmw-r937", "cve": null, "date": "2026-11-04", "updated": "2026-11-04", "title": "MCP Inspector can stall on a malicious tool output schema regex.", "severity": "medium", "cvss": 6.5, "tools": [ "mcp-protocol" ], "component": "MCP Inspector", "kind": "ghsa", "repo": "modelcontextprotocol/inspector", "affected": ">= 2.0.0, <= 2.13.0, <= 1.0.3", "patched": "2.14.0, 1.0.4", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-2fw8-7jmw-r937" ], "text": "MCP Inspector can stall on a malicious tool output schema regex." }, { "id": "GHSA-x863-g495-4cjc", "cve": null, "date": "2026-11-03", "updated": "2026-11-03", "title": "Missing user ID claims collapse authenticated principals and allow MCP session hijacking", "severity": "high", "cvss": 7.5, "tools": [ "mcp-protocol" ], "component": "MCP C# SDK", "kind": "ghsa", "repo": "modelcontextprotocol/csharp-sdk", "affected": ">= 0.1.0-preview.9, < 1.4.2, >= 2.0.0-preview.1, < 2.3.1", "patched": "1.4.2, 2.3.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/csharp-sdk/security/advisories/GHSA-x863-g495-4cjc" ], "text": "Missing user ID claims collapse authenticated principals and allow MCP session hijacking" }, { "id": "cursor-marketplace-claude-code-2026", "date": "2026-10-29", "title": "Malicious 'Anthropic.claude-code' 2.1.312 / 2.1.313 in Cursor's extension marketplace", "severity": "not rated", "cvss": null, "cve": null, "status": "resolved", "tools": [ "cursor", "claude-code" ], "component": "Cursor VS Code Extension Marketplace", "kind": "incident", "text": "Cursor says two impersonating versions (Windows / macOS) attempted an SSH backdoor. Cursor removed them, shut down and rebuilt the marketplace, and rotated keys.", "sources": [ "https://cursor.com/blog/claude-code-extension-security-notice" ], "type": "incident", "affected": null, "patched": null, "repo": null, "updated": "2026-10-29" }, { "id": "GHSA-w766-5x43-whvw", "cve": null, "date": "2026-10-28", "updated": "2026-10-28", "title": "mcp-server-git: nested gitdir file bypasses --repository confinement", "severity": "medium", "cvss": 5.3, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "ghsa", "repo": "modelcontextprotocol/servers", "affected": "< 2026.10.28", "patched": "2026.10.28", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-w766-5x43-whvw" ], "text": "mcp-server-git: nested gitdir file bypasses --repository confinement" }, { "id": "GHSA-5xjx-9qx6-jcrv", "cve": "CVE-2026-88968", "date": "2026-10-26", "updated": "2026-10-26", "title": "TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace", "severity": "high", "cvss": 7.7, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< 2.1.251", "patched": "2.1.251", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv" ], "text": "TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace" }, { "id": "postman-autoinstall-2026", "date": "2026-10-25", "title": "Postman Desktop auto-installs Codex / Claude Code plugins and pre-trusts its own startup hook", "severity": "not rated", "cvss": null, "cve": null, "status": "open", "tools": [ "codex", "claude-code", "cursor" ], "component": "Postman Desktop 12.33.4\u201312.35.1", "kind": "incident", "text": "Users report Postman's auto-existing-upgrade step installing Postman plugins into Claude Code and Codex, writing a trusted hook hash into Codex config, adding a SessionStart hook, the remote MCP server mcp.postman.com and a CLI in ~/.local/bin. Postman staff replied on Nov 3 that opt-in will be made clearer and hook approval is under review. No CVE.", "sources": [ "https://github.com/postmanlabs/postman-app-support/issues/14370", "https://news.ycombinator.com/item?id=50354960" ], "type": "incident", "affected": null, "patched": null, "repo": null, "updated": "2026-10-25" }, { "id": "GHSA-v38p-wf49-hx2j", "cve": null, "date": "2026-10-25", "updated": "2026-10-25", "title": "fetch: private-address guard bypass via IDNA hostnames (check and connect resolve different names)", "severity": "medium", "cvss": 6.3, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "ghsa", "repo": "modelcontextprotocol/servers", "affected": ">= 2026.10.10, <= 2026.10.19", "patched": "2026.10.24", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-v38p-wf49-hx2j" ], "text": "fetch: private-address guard bypass via IDNA hostnames (check and connect resolve different names)" }, { "id": "GHSA-mvf5-2qqv-rg3c", "cve": null, "date": "2026-10-25", "updated": "2026-10-25", "title": "Cross-Origin Environment Variable Exfiltration in @modelcontextprotocol/server-everything", "severity": "medium", "cvss": 6.5, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "ghsa", "repo": "modelcontextprotocol/servers", "affected": ">= 2025.9.24, <= 2026.8.31, >= 1.0.0, < 2.0.1", "patched": "2.0.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-mvf5-2qqv-rg3c" ], "text": "Cross-Origin Environment Variable Exfiltration in @modelcontextprotocol/server-everything" }, { "id": "GHSA-hhwq-wxfx-cj7g", "cve": null, "date": "2026-10-25", "updated": "2026-10-25", "title": "@modelcontextprotocol/server-filesystem list_directory_with_sizes follows symlinks and leaks outside-directory file metadata", "severity": "low", "cvss": 3.1, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "ghsa", "repo": "modelcontextprotocol/servers", "affected": ">= 2025.7.1, <= 2026.8.31, >= 1.0.0, < 2.0.1", "patched": "2.0.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-hhwq-wxfx-cj7g" ], "text": "@modelcontextprotocol/server-filesystem list_directory_with_sizes follows symlinks and leaks outside-directory file metadata" }, { "id": "GHSA-7rgq-gccq-qphx", "cve": null, "date": "2026-10-25", "updated": "2026-10-25", "title": "Path traversal via trailing quote/whitespace in validatePath (Check/Use Mismatch)", "severity": "medium", "cvss": 4.2, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "ghsa", "repo": "modelcontextprotocol/servers", "affected": ">= 2025.8.21, <= 2026.8.31, >= 1.0.0, < 2.0.1", "patched": "2.0.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-7rgq-gccq-qphx" ], "text": "Path traversal via trailing quote/whitespace in validatePath (Check/Use Mismatch)" }, { "id": "GHSA-66qx-2266-pmj6", "cve": null, "date": "2026-10-25", "updated": "2026-10-25", "title": "fetch server: SSRF guard treats the well-known NAT64 prefix 64:ff9b::/96 as public, so a metadata address is reachable on NAT64/DNS64 egress", "severity": "low", "cvss": 3.1, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "ghsa", "repo": "modelcontextprotocol/servers", "affected": ">= 2026.10.10, <= 2026.10.19", "patched": "2026.10.24", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-66qx-2266-pmj6" ], "text": "fetch server: SSRF guard treats the well-known NAT64 prefix 64:ff9b::/96 as public, so a metadata address is reachable on NAT64/DNS64 egress" }, { "id": "GHSA-53mr-w429-c597", "cve": null, "date": "2026-10-25", "updated": "2026-10-25", "title": "Parent-Directory Fallback TOCTOU in @modelcontextprotocol/server-filesystem Permits Arbitrary File Write Outside allowedDirectories", "severity": "low", "cvss": 2.2, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "ghsa", "repo": "modelcontextprotocol/servers", "affected": ">= 2025.1.14, <= 2026.8.31, < 2.0.1", "patched": "2.0.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-53mr-w429-c597" ], "text": "Parent-Directory Fallback TOCTOU in @modelcontextprotocol/server-filesystem Permits Arbitrary File Write Outside allowedDirectories" }, { "id": "GHSA-4gxg-m5jx-9j57", "cve": null, "date": "2026-10-25", "updated": "2026-10-25", "title": "Case-variant path bypasses symlink check and allows creating files outside allowed directories in server-filesystem", "severity": "medium", "cvss": 5.3, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "ghsa", "repo": "modelcontextprotocol/servers", "affected": "= 2026.8.31, >= 1.0.0, < 2.0.1", "patched": "2.0.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-4gxg-m5jx-9j57" ], "text": "Case-variant path bypasses symlink check and allows creating files outside allowed directories in server-filesystem" }, { "id": "GHSA-3jqg-r5pp-rmp2", "cve": null, "date": "2026-10-25", "updated": "2026-10-25", "title": "robots.txt enforcement bypass via HTTP redirects in mcp-server-fetch", "severity": "low", "cvss": 3.1, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "ghsa", "repo": "modelcontextprotocol/servers", "affected": ">= 0.6.1, <= 2026.10.19", "patched": "2026.10.24", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-3jqg-r5pp-rmp2" ], "text": "robots.txt enforcement bypass via HTTP redirects in mcp-server-fetch" }, { "id": "GHSA-wmjf-2m46-2352", "cve": null, "date": "2026-10-21", "updated": "2026-10-21", "title": "Missing Authentication for Critical Function in @modelcontextprotocol/inspector", "severity": "high", "cvss": 7.5, "tools": [ "mcp-protocol" ], "component": "MCP Inspector", "kind": "ghsa", "repo": "modelcontextprotocol/inspector", "affected": ">= 0.14.1, <= 1.0.2, >= 0.14.1, <= 1.0.2", "patched": "1.0.3, 1.0.3", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-wmjf-2m46-2352" ], "text": "Missing Authentication for Critical Function in @modelcontextprotocol/inspector" }, { "id": "GHSA-vcc9-3xgm-p9v4", "cve": null, "date": "2026-10-21", "updated": "2026-10-21", "title": "Incomplete fix for CVE-2025-49596: DNS-rebinding info disclosure (API token + stored OAuth tokens) in MCP Inspector", "severity": "high", "cvss": null, "tools": [ "mcp-protocol" ], "component": "MCP Inspector", "kind": "ghsa", "repo": "modelcontextprotocol/inspector", "affected": ">= 2.0.0, <= 2.11.0", "patched": "2.12.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-vcc9-3xgm-p9v4" ], "text": "Incomplete fix for CVE-2025-49596: DNS-rebinding info disclosure (API token + stored OAuth tokens) in MCP Inspector" }, { "id": "GHSA-q978-78c7-phqw", "cve": null, "date": "2026-10-21", "updated": "2026-10-21", "title": "A remote MCP server can execute arbitrary code on the user's machine through the OAuth authorization URL (PowerShell subexpression injection on Windows and WSL)", "severity": "high", "cvss": 8.8, "tools": [ "mcp-protocol" ], "component": "MCP Inspector", "kind": "ghsa", "repo": "modelcontextprotocol/inspector", "affected": ">= 2.0.0, <= 2.11.0", "patched": "2.12.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-q978-78c7-phqw" ], "text": "A remote MCP server can execute arbitrary code on the user's machine through the OAuth authorization URL (PowerShell subexpression injection on Windows and WSL)" }, { "id": "GHSA-m5pj-3536-3xcp", "cve": null, "date": "2026-10-21", "updated": "2026-10-21", "title": "MCP Inspector v2.7.0 \u2014 /api/fetch proxy has no size cap on the proxied response body (memory-exhaustion DoS)", "severity": "medium", "cvss": null, "tools": [ "mcp-protocol" ], "component": "MCP Inspector", "kind": "ghsa", "repo": "modelcontextprotocol/inspector", "affected": ">= 2.0.0, <= 2.11.0, >= 0.21.2, <= 1.0.2, >= 0.21.2, <= 1.0.2", "patched": "2.12.0, 1.0.3, 1.0.3", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-m5pj-3536-3xcp" ], "text": "MCP Inspector v2.7.0 \u2014 /api/fetch proxy has no size cap on the proxied response body (memory-exhaustion DoS)" }, { "id": "GHSA-f6mc-jg3x-vq53", "cve": null, "date": "2026-10-21", "updated": "2026-10-21", "title": "/fetch proxy leaks Authorization/Cookie headers across cross-origin redirects (regression from the SSRF hardening in v1.0.0)", "severity": "medium", "cvss": null, "tools": [ "mcp-protocol" ], "component": "MCP Inspector", "kind": "ghsa", "repo": "modelcontextprotocol/inspector", "affected": ">= 1.0.0, <= 1.0.2, >= 1.0.0, <= 1.0.2", "patched": "1.0.3, 1.0.3", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-f6mc-jg3x-vq53" ], "text": "/fetch proxy leaks Authorization/Cookie headers across cross-origin redirects (regression from the SSRF hardening in v1.0.0)" }, { "id": "GHSA-8qgq-27v6-55w3", "cve": null, "date": "2026-10-21", "updated": "2026-10-21", "title": "SSE auth/custom headers are logged verbatim by the Inspector proxy", "severity": "low", "cvss": null, "tools": [ "mcp-protocol" ], "component": "MCP Inspector", "kind": "ghsa", "repo": "modelcontextprotocol/inspector", "affected": ">= 0.14.2, <= 1.0.2, >= 0.14.2, <= 1.0.2", "patched": "1.0.3, 1.0.3", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-8qgq-27v6-55w3" ], "text": "SSE auth/custom headers are logged verbatim by the Inspector proxy" }, { "id": "GHSA-6x67-4w4w-9f3w", "cve": null, "date": "2026-10-21", "updated": "2026-10-21", "title": "Remote MCP App can steal proxy auth token and execute arbitrary local commands (RCE)", "severity": "critical", "cvss": 9.6, "tools": [ "mcp-protocol" ], "component": "MCP Inspector", "kind": "ghsa", "repo": "modelcontextprotocol/inspector", "affected": ">= 0.20.0, <= 1.0.2, >= 0.20.0, <= 1.0.2, >= 0.20.0, <= 1.0.2", "patched": "1.0.3, 1.0.3, 1.0.3", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-6x67-4w4w-9f3w" ], "text": "Remote MCP App can steal proxy auth token and execute arbitrary local commands (RCE)" }, { "id": "GHSA-4fc4-wcmh-4g86", "cve": null, "date": "2026-10-21", "updated": "2026-10-21", "title": "Malicious MCP OAuth callback can switch transport to stdio and execute arbitrary local commands (RCE)", "severity": "critical", "cvss": 9.6, "tools": [ "mcp-protocol" ], "component": "MCP Inspector", "kind": "ghsa", "repo": "modelcontextprotocol/inspector", "affected": ">= 0.13.0, <= 1.0.2, >= 0.13.0, <= 1.0.2", "patched": "1.0.3, 1.0.3", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-4fc4-wcmh-4g86" ], "text": "Malicious MCP OAuth callback can switch transport to stdio and execute arbitrary local commands (RCE)" }, { "id": "GHSA-2rq8-f55p-j2jp", "cve": null, "date": "2026-10-21", "updated": "2026-10-21", "title": "MCP Inspector leaks proxy session token to query-controlled proxy origin", "severity": "medium", "cvss": 5.3, "tools": [ "mcp-protocol" ], "component": "MCP Inspector", "kind": "ghsa", "repo": "modelcontextprotocol/inspector", "affected": ">= 0.14.1, <= 1.0.2, >= 0.14.1, <= 1.0.2", "patched": "1.0.3, 1.0.3", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-2rq8-f55p-j2jp" ], "text": "MCP Inspector leaks proxy session token to query-controlled proxy origin" }, { "id": "GHSA-w83x-jw8h-w4rj", "cve": null, "date": "2026-10-20", "updated": "2026-10-20", "title": "Server/client session dispatch returns raw handler exception messages (and the full cause chain) to the peer \u2192 information disclosure", "severity": "medium", "cvss": 5.3, "tools": [ "mcp-protocol" ], "component": "MCP Java SDK", "kind": "ghsa", "repo": "modelcontextprotocol/java-sdk", "affected": ">= 0.11.0, 0 < 0.18.5, >= 1.0.0, < 1.1.5, >= 2.0.0, < 2.1.0", "patched": "0.18.5, 1.1.5, 2.1.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-w83x-jw8h-w4rj" ], "text": "Server/client session dispatch returns raw handler exception messages (and the full cause chain) to the peer \u2192 information disclosure" }, { "id": "GHSA-hp8w-r5wh-cw9q", "cve": null, "date": "2026-10-20", "updated": "2026-10-20", "title": "Default stateless Servlet transport accepts browser cross-origin tool calls", "severity": "high", "cvss": 7.1, "tools": [ "mcp-protocol" ], "component": "MCP Java SDK", "kind": "ghsa", "repo": "modelcontextprotocol/java-sdk", "affected": ">= 0.11.0, 0 < 0.18.5, >= 1.0.0, < 1.1.5, >= 2.0.0, < 2.1.0", "patched": "0.18.5, 1.1.5, 2.1.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-hp8w-r5wh-cw9q" ], "text": "Default stateless Servlet transport accepts browser cross-origin tool calls" }, { "id": "GHSA-2hm9-qff2-hrpj", "cve": null, "date": "2026-10-20", "updated": "2026-10-20", "title": "Unbounded session retention in the Streamable HTTP transport allows an initialize flood DoS", "severity": "high", "cvss": null, "tools": [ "mcp-protocol" ], "component": "MCP Java SDK", "kind": "ghsa", "repo": "modelcontextprotocol/java-sdk", "affected": ">= 0.11.0, 0 < 0.18.5, >= 1.0.0, < 1.1.5, >= 2.0.0, < 2.1.0", "patched": "0.18.5, 1.1.5, 2.1.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-2hm9-qff2-hrpj" ], "text": "Unbounded session retention in the Streamable HTTP transport allows an initialize flood DoS" }, { "id": "GHSA-jm63-cq47-j5jp", "cve": "CVE-2026-111770", "date": "2026-10-15", "updated": "2026-10-19", "title": "Shared transport or server instances delivered one HTTP client's messages to another", "severity": "high", "cvss": 7.7, "tools": [ "mcp-protocol" ], "component": "MCP TypeScript SDK", "kind": "cve", "repo": "modelcontextprotocol/typescript-sdk", "affected": ">= 2.0.0, < 2.3.0", "patched": "2.3.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp" ], "text": "Shared transport or server instances delivered one HTTP client's messages to another" }, { "id": "GHSA-f897-62hf-6gxq", "cve": null, "date": "2026-10-15", "updated": "2026-10-15", "title": "HTTP server transports and handlers did not limit request body size or JSON-RPC batch length", "severity": "high", "cvss": 7.5, "tools": [ "mcp-protocol" ], "component": "MCP TypeScript SDK", "kind": "ghsa", "repo": "modelcontextprotocol/typescript-sdk", "affected": ">= 1.10.0, < 1.30.1, >= 2.0.0, < 2.1.0, >= 2.0.0, < 2.1.0, >= 2.0.0, < 2.0.1", "patched": "1.30.1, 2.1.0, 2.1.0, 2.0.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-f897-62hf-6gxq" ], "text": "HTTP server transports and handlers did not limit request body size or JSON-RPC batch length" }, { "id": "GHSA-46jr-4wx8-v453", "cve": "CVE-2026-111768", "date": "2026-10-15", "updated": "2026-10-19", "title": "One HTTP request within the default size limit could exhaust server memory during validation", "severity": "high", "cvss": 7.5, "tools": [ "mcp-protocol" ], "component": "MCP TypeScript SDK", "kind": "cve", "repo": "modelcontextprotocol/typescript-sdk", "affected": ">= 1.3.0, < 1.32.0, >= 2.0.0, < 2.3.0", "patched": "1.32.0, 2.3.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453" ], "text": "One HTTP request within the default size limit could exhaust server memory during validation" }, { "id": "GHSA-qghm-w43w-vx8v", "cve": "CVE-2026-102851", "date": "2026-10-13", "updated": "2026-10-13", "title": "Security Feature Bypass via Shared MCP Sandbox Permission Approvals", "severity": "medium", "cvss": null, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": "< 1.141.1", "patched": "1.141.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-qghm-w43w-vx8v" ], "text": "Security Feature Bypass via Shared MCP Sandbox Permission Approvals" }, { "id": "GHSA-fq62-m6f5-c7h9", "cve": "CVE-2026-102232", "date": "2026-10-13", "updated": "2026-10-13", "title": "Remote Code Execution via Custom Hook Edits in the Copilot Harness", "severity": "high", "cvss": null, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": "< 1.141.1", "patched": "1.141.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-fq62-m6f5-c7h9" ], "text": "Remote Code Execution via Custom Hook Edits in the Copilot Harness" }, { "id": "GHSA-4p2j-qj3c-6x84", "cve": "CVE-2026-88066", "date": "2026-10-13", "updated": "2026-10-13", "title": "Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable", "severity": "high", "cvss": 7.5, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< 1.8089.0", "patched": "1.8089.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84" ], "text": "Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable" }, { "id": "GHSA-pq7j-f95f-qfcv", "cve": "CVE-2026-86063", "date": "2026-10-09", "updated": "2026-10-09", "title": "Plugin Commit SHA Pin Bypass Allows Installation of Attacker-Controlled Code", "severity": "high", "cvss": 7.7, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< 2.1.179", "patched": "2.1.179", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv" ], "text": "Plugin Commit SHA Pin Bypass Allows Installation of Attacker-Controlled Code" }, { "id": "GHSA-9g5j-qgqm-857j", "cve": "CVE-2026-107332", "date": "2026-10-08", "updated": "2026-10-08", "title": "Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code", "severity": "medium", "cvss": 5.5, "tools": [ "amazon-q" ], "component": "Amazon Q Developer for VS Code", "kind": "cve", "repo": "aws/aws-toolkit-vscode", "affected": "< 4.10.0", "patched": "4.10.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-9g5j-qgqm-857j" ], "text": "Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code" }, { "id": "GHSA-w4fh-qvv9-3v23", "cve": "CVE-2026-116684", "date": "2026-10-05", "updated": "2026-10-27", "title": "Server bearer-token authentication accepts tokens issued for a different resource server", "severity": "medium", "cvss": 6.8, "tools": [ "mcp-protocol" ], "component": "MCP Python SDK", "kind": "cve", "repo": "modelcontextprotocol/python-sdk", "affected": ">= 2.0.0, < 2.2.0, >= 1.10.0, < 1.30.0", "patched": "2.2.0, 1.30.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23" ], "text": "Server bearer-token authentication accepts tokens issued for a different resource server" }, { "id": "GHSA-rvq5-wwqv-78pq", "cve": "CVE-2026-111771", "date": "2026-10-05", "updated": "2026-10-19", "title": "Server bearer authentication accepted tokens issued for another service", "severity": "medium", "cvss": 6.8, "tools": [ "mcp-protocol" ], "component": "MCP TypeScript SDK", "kind": "cve", "repo": "modelcontextprotocol/typescript-sdk", "affected": ">= 1.6.0, < 1.32.0, >= 2.0.0, < 2.3.0, >= 2.0.0, < 2.0.2, >= 2.0.0, < 2.3.1", "patched": "1.32.0, 2.3.0, 2.0.2, 2.3.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq" ], "text": "Server bearer authentication accepted tokens issued for another service" }, { "id": "GHSA-5j29-h97v-84ch", "cve": "CVE-2026-103435", "date": "2026-10-05", "updated": "2026-10-05", "title": "Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code", "severity": "high", "cvss": 7.7, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< 2.1.129", "patched": "2.1.129", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-5j29-h97v-84ch" ], "text": "Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code" }, { "id": "GHSA-6prh-2h8m-c8cw", "cve": "CVE-2026-111769", "date": "2026-10-02", "updated": "2026-10-19", "title": "HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies", "severity": "medium", "cvss": 6.5, "tools": [ "mcp-protocol" ], "component": "MCP TypeScript SDK", "kind": "cve", "repo": "modelcontextprotocol/typescript-sdk", "affected": "< 1.32.0, >= 2.0.0, < 2.3.0", "patched": "1.32.0, 2.3.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw" ], "text": "HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies" }, { "id": "GHSA-5h93-6whr-6q8j", "cve": "CVE-2026-116685", "date": "2026-10-02", "updated": "2026-10-27", "title": "HTTP client transports followed cross-origin redirects carrying custom headers and bodies", "severity": "medium", "cvss": 5.9, "tools": [ "mcp-protocol" ], "component": "MCP Python SDK", "kind": "cve", "repo": "modelcontextprotocol/python-sdk", "affected": ">= 2.0.0, < 2.2.0, >= 1.8.0, < 1.30.0", "patched": "2.2.0, 1.30.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-5h93-6whr-6q8j" ], "text": "HTTP client transports followed cross-origin redirects carrying custom headers and bodies" }, { "id": "GHSA-22jm-h49p-29qw", "cve": "CVE-2026-111767", "date": "2026-10-02", "updated": "2026-10-19", "title": "Experimental tasks were not tied to the session that created them", "severity": "high", "cvss": 8.6, "tools": [ "mcp-protocol" ], "component": "MCP TypeScript SDK", "kind": "cve", "repo": "modelcontextprotocol/typescript-sdk", "affected": ">= 1.24.0, < 1.32.0", "patched": "1.32.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw" ], "text": "Experimental tasks were not tied to the session that created them" }, { "id": "GHSA-fmmv-w9g8-j3gc", "cve": "CVE-2026-109527", "date": "2026-09-30", "updated": "2026-10-14", "title": "HTTP server transports and OAuth endpoints read request bodies with no size limit", "severity": "high", "cvss": 7.5, "tools": [ "mcp-protocol" ], "component": "MCP Python SDK", "kind": "cve", "repo": "modelcontextprotocol/python-sdk", "affected": "< 1.29.1, >= 2.0.0, < 2.1.0", "patched": "1.29.1, 2.1.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc" ], "text": "HTTP server transports and OAuth endpoints read request bodies with no size limit" }, { "id": "GHSA-84m7-p3x7-pcfv", "cve": "CVE-2026-59951", "date": "2026-09-30", "updated": "2026-09-30", "title": "Streamable HTTP sessions were never reclaimed by default and kept their initialize payloads", "severity": "high", "cvss": 7.5, "tools": [ "mcp-protocol" ], "component": "MCP Python SDK", "kind": "cve", "repo": "modelcontextprotocol/python-sdk", "affected": ">= 1.8.0, < 1.30.0, >= 2.0.0, < 2.2.0", "patched": "1.30.0, 2.2.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-84m7-p3x7-pcfv" ], "text": "Streamable HTTP sessions were never reclaimed by default and kept their initialize payloads" }, { "id": "GHSA-6qxp-vccf-f47h", "cve": "CVE-2026-104850", "date": "2026-09-30", "updated": "2026-10-02", "title": "OAuth client could send credentials to an authorization server chosen by the MCP server", "severity": "high", "cvss": 7.5, "tools": [ "mcp-protocol" ], "component": "MCP TypeScript SDK", "kind": "cve", "repo": "modelcontextprotocol/typescript-sdk", "affected": ">= 1.12.0, < 1.31.0, >= 2.0.0, < 2.2.0", "patched": "1.31.0, 2.2.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h" ], "text": "OAuth client could send credentials to an authorization server chosen by the MCP server" }, { "id": "GHSA-gfvf-j8jh-jxxw", "cve": "CVE-2026-103012", "date": "2026-09-29", "updated": "2026-09-29", "title": "Managed Settings Not Applied When a Stored API Key Was Preferred Over Enterprise Sign-In", "severity": "low", "cvss": 2.0, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": ">= 2.0.68, < 2.1.260", "patched": "2.1.260", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-gfvf-j8jh-jxxw" ], "text": "Managed Settings Not Applied When a Stored API Key Was Preferred Over Enterprise Sign-In" }, { "id": "GHSA-rwrf-2pqf-9j8j", "cve": "CVE-2026-116686", "date": "2026-09-28", "updated": "2026-10-27", "title": "Client fetched server-chosen $ref URLs while validating tool results against output schemas", "severity": "medium", "cvss": 6.5, "tools": [ "mcp-protocol" ], "component": "MCP Python SDK", "kind": "cve", "repo": "modelcontextprotocol/python-sdk", "affected": ">= 2.0.0, < 2.2.0, >= 1.10.0, < 1.30.0", "patched": "2.2.0, 1.30.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-rwrf-2pqf-9j8j" ], "text": "Client fetched server-chosen $ref URLs while validating tool results against output schemas" }, { "id": "GHSA-qx49-fqc8-xw99", "cve": "CVE-2026-115563", "date": "2026-09-28", "updated": "2026-10-23", "title": "OAuth client could send credentials to an authorization server chosen by the MCP server", "severity": "high", "cvss": 7.5, "tools": [ "mcp-protocol" ], "component": "MCP Python SDK", "kind": "cve", "repo": "modelcontextprotocol/python-sdk", "affected": ">= 2.0.0a1, < 2.2.0, >= 1.9.1, < 1.30.0", "patched": "2.2.0, 1.30.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-qx49-fqc8-xw99" ], "text": "OAuth client could send credentials to an authorization server chosen by the MCP server" }, { "id": "GHSA-v234-4jrq-mgg6", "cve": null, "date": "2026-09-25", "updated": "2026-09-25", "title": "Claude Desktop (macOS): opening a malicious file from a Cowork folder could run commands on the host", "severity": "high", "cvss": 8.5, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "ghsa", "repo": "anthropics/claude-code", "affected": ">= 1.1.3918, < 1.15962.0", "patched": "1.15962.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-v234-4jrq-mgg6" ], "text": "Claude Desktop (macOS): opening a malicious file from a Cowork folder could run commands on the host" }, { "id": "GHSA-vww8-mqc2-4x8v", "cve": "CVE-2026-81380", "date": "2026-09-08", "updated": "2026-09-08", "title": "Information Disclosure through Automatic Remote Image Fetch in Chat", "severity": "medium", "cvss": 5.3, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": "< 1.136.2", "patched": "1.136.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-vww8-mqc2-4x8v" ], "text": "Information Disclosure through Automatic Remote Image Fetch in Chat" }, { "id": "GHSA-rvgr-2w56-2j67", "cve": "CVE-2026-81381", "date": "2026-09-08", "updated": "2026-09-08", "title": "Azure DevOps access token disclosure through GitHub Copilot Chat workspace settings", "severity": "medium", "cvss": 6.5, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": "< 1.136.2", "patched": "1.136.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-rvgr-2w56-2j67" ], "text": "Azure DevOps access token disclosure through GitHub Copilot Chat workspace settings" }, { "id": "GHSA-hr37-8jwr-q8p8", "cve": "CVE-2026-81379", "date": "2026-09-08", "updated": "2026-09-08", "title": "Agent Network Filter Bypass Vulnerability", "severity": "high", "cvss": 8.2, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": "< 1.136.2", "patched": "1.136.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-hr37-8jwr-q8p8" ], "text": "Agent Network Filter Bypass Vulnerability" }, { "id": "GHSA-g6p5-6xp8-5jwg", "cve": "CVE-2026-81377", "date": "2026-09-08", "updated": "2026-09-08", "title": "Visual Studio Code MCP gallery metadata path traversal", "severity": "medium", "cvss": 6.5, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": ">= 1.0.0, < 1.136.2", "patched": "1.136.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-g6p5-6xp8-5jwg" ], "text": "Visual Studio Code MCP gallery metadata path traversal" }, { "id": "GHSA-4xcg-6mm5-hj26", "cve": "CVE-2026-81357", "date": "2026-09-08", "updated": "2026-09-08", "title": "Agent Network Filter Security Feature Bypass", "severity": "high", "cvss": 8.2, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": "< 1.136.2", "patched": "1.136.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-4xcg-6mm5-hj26" ], "text": "Agent Network Filter Security Feature Bypass" }, { "id": "GHSA-4gv7-q2x8-32p8", "cve": "CVE-2026-81378", "date": "2026-09-08", "updated": "2026-09-08", "title": "Agent Network Filter Security Feature Bypass", "severity": "high", "cvss": 8.2, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": "< 1.136.2", "patched": "1.136.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-4gv7-q2x8-32p8" ], "text": "Agent Network Filter Security Feature Bypass" }, { "id": "GHSA-2cmq-rv52-5rf6", "cve": "CVE-2026-78462", "date": "2026-09-08", "updated": "2026-09-08", "title": "Remote code execution through workspace-configured remote agent host connections", "severity": "high", "cvss": 8.8, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": "< 1.136.2", "patched": "1.136.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-2cmq-rv52-5rf6" ], "text": "Remote code execution through workspace-configured remote agent host connections" }, { "id": "GHSA-5q7x-232h-f834", "cve": null, "date": "2026-08-19", "updated": "2026-08-19", "title": "Unbounded reads when parsing Server-Sent Events in HTTP client transports", "severity": "medium", "cvss": 6.5, "tools": [ "mcp-protocol" ], "component": "MCP Java SDK", "kind": "ghsa", "repo": "modelcontextprotocol/java-sdk", "affected": ">= 0.18.0, < 0.18.4, >= 1.0.0, < 1.1.4, 2.0.0", "patched": "0.18.4, 1.1.4, 2.0.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-5q7x-232h-f834" ], "text": "Unbounded reads when parsing Server-Sent Events in HTTP client transports" }, { "id": "GHSA-4x8c-5vv7-973f", "cve": "CVE-2026-108395", "date": "2026-08-19", "updated": "2026-10-14", "title": "Unbounded request-body reads in mcp-core HTTP server transports allow remote denial of service (CWE-770)", "severity": "high", "cvss": 7.5, "tools": [ "mcp-protocol" ], "component": "MCP Java SDK", "kind": "cve", "repo": "modelcontextprotocol/java-sdk", "affected": ">= 0.18.0, < 0.18.4, >= 1.0.0, < 1.1.4, 2.0.0", "patched": "0.18.4, 1.1.4, 2.0.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-4x8c-5vv7-973f" ], "text": "Unbounded request-body reads in mcp-core HTTP server transports allow remote denial of service (CWE-770)" }, { "id": "GHSA-6xp2-9cj3-f488", "cve": "CVE-2026-69306", "date": "2026-08-12", "updated": "2026-08-12", "title": "Agent network filter bypass via IPv4-mapped IPv6 literals", "severity": "high", "cvss": 8.2, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": "< 1.132.1", "patched": "1.132.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-6xp2-9cj3-f488" ], "text": "Agent network filter bypass via IPv4-mapped IPv6 literals" }, { "id": "GHSA-w79w-rj9h-vg4f", "cve": "CVE-2026-70335", "date": "2026-08-11", "updated": "2026-08-11", "title": "Copilot Custom Agent Hook Remote Code Execution Vulnerability", "severity": "high", "cvss": 7.8, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": "< 1.132.1", "patched": "1.132.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-w79w-rj9h-vg4f" ], "text": "Copilot Custom Agent Hook Remote Code Execution Vulnerability" }, { "id": "GHSA-3hjg-cwxj-qfc6", "cve": "CVE-2026-65675", "date": "2026-08-11", "updated": "2026-08-11", "title": "Copilot Chat Security Feature Bypass Vulnerability", "severity": "high", "cvss": 7.1, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": "< 1.132.1", "patched": "1.132.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-3hjg-cwxj-qfc6" ], "text": "Copilot Chat Security Feature Bypass Vulnerability" }, { "id": "shai-hulud-mcp-registry-2026", "date": "2026-08-09", "title": "Shai-Hulud worm payload delivered through an official MCP Registry entry", "severity": "not rated", "cvss": null, "cve": null, "status": "research", "tools": [ "mcp-protocol", "copilot", "claude-code" ], "component": "MCP Registry (V.A.P.E entry)", "kind": "research", "text": "OX Security reports a registry-listed MCP server shipping a payload that wrote malicious .vscode/settings.json and .claude/settings.json files.", "sources": [ "https://www.ox.security/blog/shai-hulud-outbreak-debrief-the-worm-evolves-into-mcp/" ], "type": "incident", "affected": null, "patched": null, "repo": null, "updated": "2026-08-09" }, { "id": "GHSA-r5pp-p5r8-466r", "cve": "CVE-2026-72718", "date": "2026-07-24", "updated": "2026-08-10", "title": "Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor", "severity": "high", "cvss": 7.0, "tools": [ "goose" ], "component": "Goose", "kind": "cve", "repo": "aaif-goose/goose", "affected": "< 1.44.0", "patched": "1.44.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r" ], "text": "Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor" }, { "id": "GHSA-w4q6-qw23-4rg7", "cve": "CVE-2026-47427", "date": "2026-07-20", "updated": "2026-07-20", "title": "Nil Pointer Dereference DoS in completion/complete Handler", "severity": "high", "cvss": 7.5, "tools": [ "copilot" ], "component": "GitHub MCP Server", "kind": "cve", "repo": "github/github-mcp-server", "affected": "<= 0.33.0 (also affects latest main)", "patched": null, "status": "no fix listed", "type": "ghsa", "sources": [ "https://github.com/github/github-mcp-server/security/advisories/GHSA-w4q6-qw23-4rg7" ], "text": "Nil Pointer Dereference DoS in completion/complete Handler" }, { "id": "GHSA-v4xv-rqh3-w9mc", "cve": "CVE-2026-73218", "date": "2026-07-14", "updated": "2026-08-11", "title": "Sandbox escape via launching privileged containers", "severity": "high", "cvss": null, "tools": [ "cursor" ], "component": "Cursor", "kind": "cve", "repo": "cursor/cursor", "affected": "<3.0.0", "patched": null, "status": "no fix listed", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-v4xv-rqh3-w9mc" ], "text": "Sandbox escape via launching privileged containers" }, { "id": "GHSA-p9g2-cr55-cw9c", "cve": "CVE-2026-73217", "date": "2026-07-14", "updated": "2026-08-11", "title": "Sandbox escape via tampered Python virtual environments", "severity": "high", "cvss": null, "tools": [ "cursor" ], "component": "Cursor", "kind": "cve", "repo": "cursor/cursor", "affected": "<3.1.2", "patched": "3.1.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-p9g2-cr55-cw9c" ], "text": "Sandbox escape via tampered Python virtual environments" }, { "id": "GHSA-vj7q-gjh5-988w", "cve": "CVE-2026-59950", "date": "2026-07-07", "updated": "2026-07-07", "title": "WebSocket server transport does not support Host/Origin validation", "severity": "high", "cvss": 7.6, "tools": [ "mcp-protocol" ], "component": "MCP Python SDK", "kind": "cve", "repo": "modelcontextprotocol/python-sdk", "affected": "< 1.28.1", "patched": "1.28.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-vj7q-gjh5-988w" ], "text": "WebSocket server transport does not support Host/Origin validation" }, { "id": "GHSA-whx2-4gvm-m3r3", "cve": "CVE-2026-61613", "date": "2026-07-06", "updated": "2026-07-10", "title": "Cloud Agent Browser Sandbox Escape", "severity": "high", "cvss": 7.7, "tools": [ "cursor" ], "component": "Cursor", "kind": "cve", "repo": "cursor/cursor", "affected": "<03/31/2026", "patched": "Fixed on 03/31/2026", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-whx2-4gvm-m3r3" ], "text": "Cloud Agent Browser Sandbox Escape" }, { "id": "GHSA-7835-87q9-rgvv", "cve": "CVE-2026-55607", "date": "2026-06-25", "updated": "2026-06-25", "title": "Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution", "severity": "high", "cvss": 7.7, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": ">= 2.1.38, < 2.1.163", "patched": "2.1.163", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv" ], "text": "Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution" }, { "id": "GHSA-4vp2-6q8c-pvq2", "cve": "CVE-2026-46406", "date": "2026-06-25", "updated": "2026-06-25", "title": "Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write", "severity": "medium", "cvss": 4.4, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": ">= 2.1.59, < 2.1.128", "patched": "2.1.128", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-4vp2-6q8c-pvq2" ], "text": "Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write" }, { "id": "GHSA-3cj3-hqcr-g934", "cve": "CVE-2026-59723", "date": "2026-06-23", "updated": "2026-07-07", "title": "Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)", "severity": "high", "cvss": 8.8, "tools": [ "cline" ], "component": "Cline", "kind": "cve", "repo": "cline/cline", "affected": "<= 3.0.24", "patched": null, "status": "no fix listed", "type": "ghsa", "sources": [ "https://github.com/cline/cline/security/advisories/GHSA-3cj3-hqcr-g934" ], "text": "Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)" }, { "id": "GHSA-fg94-h982-f3mm", "cve": "CVE-2026-54316", "date": "2026-06-13", "updated": "2026-06-13", "title": "Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch", "severity": "medium", "cvss": 6.0, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": ">= 0.2.54, < 2.1.163", "patched": "2.1.163", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm" ], "text": "Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch" }, { "id": "GHSA-pjp5-fpmr-3349", "cve": "CVE-2026-48529", "date": "2026-06-09", "updated": "2026-06-09", "title": "Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion", "severity": "medium", "cvss": 6.0, "tools": [ "copilot" ], "component": "GitHub MCP Server", "kind": "cve", "repo": "github/github-mcp-server", "affected": ">= 0.22.0, < 1.1.2", "patched": "1.1.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349" ], "text": "Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion" }, { "id": "GHSA-jpw9-pfvf-9f58", "cve": "CVE-2026-52869", "date": "2026-06-05", "updated": "2026-06-09", "title": "HTTP transports serve session requests without verifying the authenticated principal", "severity": "high", "cvss": 7.1, "tools": [ "mcp-protocol" ], "component": "MCP Python SDK", "kind": "cve", "repo": "modelcontextprotocol/python-sdk", "affected": "<=1.27.1", "patched": "1.27.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-jpw9-pfvf-9f58" ], "text": "HTTP transports serve session requests without verifying the authenticated principal" }, { "id": "GHSA-hvrp-rf83-w775", "cve": "CVE-2026-52870", "date": "2026-06-05", "updated": "2026-06-09", "title": "Experimental task handlers allow any client to access and cancel other clients' tasks", "severity": "high", "cvss": 7.6, "tools": [ "mcp-protocol" ], "component": "MCP Python SDK", "kind": "cve", "repo": "modelcontextprotocol/python-sdk", "affected": ">= 1.23.0, <= 1.27.1", "patched": "1.27.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-hvrp-rf83-w775" ], "text": "Experimental task handlers allow any client to access and cancel other clients' tasks" }, { "id": "GHSA-3v8f-48vw-3mjx", "cve": "CVE-2026-50549", "date": "2026-06-05", "updated": "2026-06-05", "title": "Cursor Desktop sandbox escape via symlink and failed path canonicalization", "severity": "critical", "cvss": null, "tools": [ "cursor" ], "component": "Cursor", "kind": "cve", "repo": "cursor/cursor", "affected": "< 3.0", "patched": "3.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-3v8f-48vw-3mjx" ], "text": "Cursor Desktop sandbox escape via symlink and failed path canonicalization" }, { "id": "GHSA-3p48-7v9f-v5cw", "cve": "CVE-2026-50548", "date": "2026-06-05", "updated": "2026-06-05", "title": "Cursor Desktop sandbox escape via agent-controlled working directory", "severity": "critical", "cvss": null, "tools": [ "cursor" ], "component": "Cursor", "kind": "cve", "repo": "cursor/cursor", "affected": "< 3.0", "patched": "3.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-3p48-7v9f-v5cw" ], "text": "Cursor Desktop sandbox escape via agent-controlled working directory" }, { "id": "GHSA-pc9j-3qc2-95wv", "cve": "CVE-2026-48124", "date": "2026-05-21", "updated": "2026-05-21", "title": "Cursor Desktop sandbox escape via Claude hook configuration", "severity": "high", "cvss": 8.5, "tools": [ "cursor" ], "component": "Cursor", "kind": "cve", "repo": "cursor/cursor", "affected": "2.4.37", "patched": "3.0.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-pc9j-3qc2-95wv" ], "text": "Cursor Desktop sandbox escape via Claude hook configuration" }, { "id": "GHSA-9f6c-63gp-pwpf", "cve": "CVE-2026-41613", "date": "2026-05-12", "updated": "2026-05-12", "title": "MCP Deeplink Install Lacked Essential Information", "severity": "high", "cvss": 8.8, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": "<1.119.1", "patched": null, "status": "no fix listed", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-9f6c-63gp-pwpf" ], "text": "MCP Deeplink Install Lacked Essential Information" }, { "id": "GHSA-rqq3-p6x4-q866", "cve": "CVE-2026-44462", "date": "2026-05-08", "updated": "2026-05-08", "title": "Allowlist Bypass via Bash Variable Expansion Chain in Terminal Tool Permissions", "severity": "medium", "cvss": 6.4, "tools": [ "zed" ], "component": "Zed", "kind": "cve", "repo": "zed-industries/zed", "affected": "=v0.229.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/zed-industries/zed/security/advisories/GHSA-rqq3-p6x4-q866" ], "text": "Allowlist Bypass via Bash Variable Expansion Chain in Terminal Tool Permissions" }, { "id": "GHSA-fj2r-rmw6-h222", "cve": "CVE-2026-44465", "date": "2026-05-08", "updated": "2026-05-08", "title": "Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config", "severity": "high", "cvss": 8.6, "tools": [ "zed" ], "component": "Zed", "kind": "cve", "repo": "zed-industries/zed", "affected": "=v0.227.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/zed-industries/zed/security/advisories/GHSA-fj2r-rmw6-h222" ], "text": "Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config" }, { "id": "GHSA-c99f-97vf-4h5h", "cve": "CVE-2026-44466", "date": "2026-05-08", "updated": "2026-05-08", "title": "Allowlist Bypass via Bash Arithmetic Expansion in Terminal Tool Permissions", "severity": "high", "cvss": 8.6, "tools": [ "zed" ], "component": "Zed", "kind": "cve", "repo": "zed-industries/zed", "affected": "=v0.229.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/zed-industries/zed/security/advisories/GHSA-c99f-97vf-4h5h" ], "text": "Allowlist Bypass via Bash Arithmetic Expansion in Terminal Tool Permissions" }, { "id": "GHSA-c3g6-c3ff-69cg", "cve": "CVE-2026-44463", "date": "2026-05-08", "updated": "2026-05-08", "title": "Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions", "severity": "high", "cvss": 8.6, "tools": [ "zed" ], "component": "Zed", "kind": "cve", "repo": "zed-industries/zed", "affected": "=v0.229.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/zed-industries/zed/security/advisories/GHSA-c3g6-c3ff-69cg" ], "text": "Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions" }, { "id": "GHSA-63qj-jc2q-7hg5", "cve": "CVE-2026-44461", "date": "2026-05-08", "updated": "2026-05-08", "title": "Remote Command Injection via Unquoted Environment Variable Keys (SSH / WSL Remote) in Zed v0.225.9", "severity": "high", "cvss": 8.6, "tools": [ "zed" ], "component": "Zed", "kind": "cve", "repo": "zed-industries/zed", "affected": "<=0.225.9", "patched": ">=v0.227.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/zed-industries/zed/security/advisories/GHSA-63qj-jc2q-7hg5" ], "text": "Remote Command Injection via Unquoted Environment Variable Keys (SSH / WSL Remote) in Zed v0.225.9" }, { "id": "GHSA-5c57-rqjx-35g2", "cve": "CVE-2026-44211", "date": "2026-05-08", "updated": "2026-05-08", "title": "Cross-Origin WebSocket Hijack in Cline Kanban Server", "severity": "critical", "cvss": 9.6, "tools": [ "cline" ], "component": "Cline", "kind": "cve", "repo": "cline/cline", "affected": "= 1.2581.0, < 1.4304.0", "patched": "1.4304.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-3rwf-2g6p-c2f9" ], "text": "SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions" }, { "id": "GHSA-wpqr-6v78-jr5g", "cve": "CVE-2026-12537", "date": "2026-04-24", "updated": "2026-09-24", "title": "Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses", "severity": "critical", "cvss": 10.0, "tools": [ "gemini" ], "component": "Gemini CLI", "kind": "cve", "repo": "google-github-actions/run-gemini-cli", "affected": "< 0.39.1, = 0.40.0-preview.2, < 0.1.22", "patched": "0.39.1, 0.40.0-preview.3, 0.1.22", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/advisories/GHSA-wpqr-6v78-jr5g" ], "text": "Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses" }, { "id": "GHSA-q5hj-mxqh-vv77", "cve": "CVE-2026-40068", "date": "2026-04-24", "updated": "2026-04-24", "title": "Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution", "severity": "high", "cvss": 7.7, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": ">= 2.1.63, < 2.1.84", "patched": "2.1.84", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-q5hj-mxqh-vv77" ], "text": "Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution" }, { "id": "GHSA-vp62-r36r-9xqp", "cve": "CVE-2026-39861", "date": "2026-04-20", "updated": "2026-04-20", "title": "Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace", "severity": "high", "cvss": 7.7, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< 2.1.64", "patched": "2.1.64", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-vp62-r36r-9xqp" ], "text": "Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace" }, { "id": "GHSA-5cwg-9f6j-9jvx", "cve": "CVE-2026-35603", "date": "2026-04-17", "updated": "2026-04-17", "title": "Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows", "severity": "medium", "cvss": 5.4, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< 2.1.75", "patched": "2.1.75", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-5cwg-9f6j-9jvx" ], "text": "Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows" }, { "id": "GHSA-xrxf-jgv3-qmrm", "cve": "CVE-2025-61260", "date": "2026-04-14", "updated": "2026-04-16", "title": "OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files", "severity": "critical", "cvss": 9.8, "tools": [ "codex" ], "component": "Codex CLI", "kind": "cve", "repo": "openai/codex", "affected": "<= 0.23.0", "patched": null, "status": "no fix listed", "type": "ghsa", "sources": [ "https://github.com/advisories/GHSA-xrxf-jgv3-qmrm" ], "text": "OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files" }, { "id": "GHSA-8jxr-pr72-r468", "cve": "CVE-2026-35568", "date": "2026-04-07", "updated": "2026-04-07", "title": "DNS Rebinding Vulnerability in Java-SDK", "severity": "high", "cvss": 7.6, "tools": [ "mcp-protocol" ], "component": "MCP Java SDK", "kind": "cve", "repo": "modelcontextprotocol/java-sdk", "affected": "< 1.0.0", "patched": "1.0.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-8jxr-pr72-r468" ], "text": "DNS Rebinding Vulnerability in Java-SDK" }, { "id": "GHSA-xw59-hvm2-8pj6", "cve": "CVE-2026-34742", "date": "2026-03-30", "updated": "2026-03-30", "title": "DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost", "severity": "high", "cvss": 7.6, "tools": [ "mcp-protocol" ], "component": "MCP Go SDK", "kind": "cve", "repo": "modelcontextprotocol/go-sdk", "affected": "< 1.4.0", "patched": "1.4.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-xw59-hvm2-8pj6" ], "text": "DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost" }, { "id": "GHSA-hv2w-8mjj-jw22", "cve": "CVE-2026-34237", "date": "2026-03-30", "updated": "2026-06-09", "title": "Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)", "severity": "medium", "cvss": 6.1, "tools": [ "mcp-protocol" ], "component": "MCP Java SDK", "kind": "cve", "repo": "modelcontextprotocol/java-sdk", "affected": "< 1.0.0, < 1.1.1, < 0.18.3", "patched": "1.0.1, 1.1.1, 0.18.3", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-hv2w-8mjj-jw22" ], "text": "Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)" }, { "id": "GHSA-q382-vc8q-7jhj", "cve": null, "date": "2026-03-18", "updated": "2026-03-18", "title": "Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk", "severity": "high", "cvss": null, "tools": [ "mcp-protocol" ], "component": "MCP Go SDK", "kind": "ghsa", "repo": "modelcontextprotocol/go-sdk", "affected": "<= 1.4.0", "patched": "1.4.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-q382-vc8q-7jhj" ], "text": "Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk" }, { "id": "GHSA-mmgp-wc2j-qcv7", "cve": "CVE-2026-33068", "date": "2026-03-18", "updated": "2026-03-18", "title": "Workspace Trust Dialog Bypass via Repo-Controlled Settings File", "severity": "high", "cvss": 7.7, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< 2.1.53", "patched": "2.1.53", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-mmgp-wc2j-qcv7" ], "text": "Workspace Trust Dialog Bypass via Repo-Controlled Settings File" }, { "id": "GHSA-89xv-2j6f-qhc8", "cve": "CVE-2026-33252", "date": "2026-03-18", "updated": "2026-03-18", "title": "Cross-Site Tool Execution for HTTP Servers without Authorization in github.com/modelcontextprotocol/go-sdk", "severity": "high", "cvss": 7.1, "tools": [ "mcp-protocol" ], "component": "MCP Go SDK", "kind": "cve", "repo": "modelcontextprotocol/go-sdk", "affected": "<= 1.4.0", "patched": "1.4.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-89xv-2j6f-qhc8" ], "text": "Cross-Site Tool Execution for HTTP Servers without Authorization in github.com/modelcontextprotocol/go-sdk" }, { "id": "glassworm-wave5-2026", "date": "2026-03-16", "title": "GlassWorm wave 5: malicious MCP server on npm and 72+ fake OpenVSX extensions", "severity": "not rated", "cvss": null, "cve": null, "status": "research", "tools": [ "mcp-protocol" ], "component": "npm @iflow-mcp/watercrawl-watercrawl-mcp 1.3.0\u20131.3.4; OpenVSX", "kind": "research", "text": "Palo Alto Networks reports a malicious MCP server package (flagged Mar 12) and 72+ malicious OpenVSX extensions, some impersonating Claude Code and Codex.", "sources": [ "https://www.paloaltonetworks.com/blog/security-operations/glassworm-wave-5-malicious-mcp-servers/" ], "type": "incident", "affected": null, "patched": null, "repo": null, "updated": "2026-03-16" }, { "id": "GHSA-hf2x-r83r-qw5q", "cve": "CVE-2026-31854", "date": "2026-03-09", "updated": "2026-03-09", "title": "Arbitrary Code Execution via Prompt Injection and Whitelist Bypass", "severity": "high", "cvss": null, "tools": [ "cursor" ], "component": "Cursor", "kind": "cve", "repo": "cursor/cursor", "affected": "<=1.4.5(latest)", "patched": "2.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-hf2x-r83r-qw5q" ], "text": "Arbitrary Code Execution via Prompt Injection and Whitelist Bypass" }, { "id": "GHSA-wvj2-96wp-fq3f", "cve": "CVE-2026-27896", "date": "2026-02-25", "updated": "2026-02-25", "title": "Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk", "severity": "high", "cvss": 7.0, "tools": [ "mcp-protocol" ], "component": "MCP Go SDK", "kind": "cve", "repo": "modelcontextprotocol/go-sdk", "affected": "< v1.3.1", "patched": "v1.3.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f" ], "text": "Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk" }, { "id": "GHSA-vjqx-cfc4-9h6v", "cve": "CVE-2026-27735", "date": "2026-02-25", "updated": "2026-02-25", "title": "Path traversal in git_add allows staging files outside repository boundaries in mcp-server-git", "severity": "medium", "cvss": 6.4, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "cve", "repo": "modelcontextprotocol/servers", "affected": "< 2026.1.14", "patched": "2026.1.14", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-vjqx-cfc4-9h6v" ], "text": "Path traversal in git_add allows staging files outside repository boundaries in mcp-server-git" }, { "id": "GHSA-v385-xh3h-rrfr", "cve": "CVE-2026-27800", "date": "2026-02-25", "updated": "2026-02-25", "title": "Zip Slip Path Traversal in Extension Archive Extraction", "severity": "high", "cvss": 7.4, "tools": [ "zed" ], "component": "Zed", "kind": "cve", "repo": "zed-industries/zed", "affected": "=v0.224.4", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/zed-industries/zed/security/advisories/GHSA-v385-xh3h-rrfr" ], "text": "Zip Slip Path Traversal in Extension Archive Extraction" }, { "id": "GHSA-786m-x2vc-5235", "cve": "CVE-2026-27967", "date": "2026-02-25", "updated": "2026-02-25", "title": "Symlink Escape in Agent File Tools", "severity": "high", "cvss": 7.1, "tools": [ "zed" ], "component": "Zed", "kind": "cve", "repo": "zed-industries/zed", "affected": "<0.225.9", "patched": ">=v0.225.9", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/zed-industries/zed/security/advisories/GHSA-786m-x2vc-5235" ], "text": "Symlink Escape in Agent File Tools" }, { "id": "GHSA-59p4-3mhm-qm3r", "cve": "CVE-2026-27976", "date": "2026-02-25", "updated": "2026-02-25", "title": "Zed Extension Sandbox Escape via Tar Symlink Following", "severity": "high", "cvss": 8.8, "tools": [ "zed" ], "component": "Zed", "kind": "cve", "repo": "zed-industries/zed", "affected": "=v0.224.4", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/zed-industries/zed/security/advisories/GHSA-59p4-3mhm-qm3r" ], "text": "Zed Extension Sandbox Escape via Tar Symlink Following" }, { "id": "GHSA-9ppg-jx86-fqw7", "cve": null, "date": "2026-02-17", "updated": "2026-02-17", "title": "Unauthorized npm publish of Cline CLI cline@2.3.0 with modified postinstall script to install openclaw", "severity": "low", "cvss": null, "tools": [ "cline" ], "component": "Cline", "kind": "ghsa", "repo": "cline/cline", "affected": "2.3.0", "patched": ">=2.4.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cline/cline/security/advisories/GHSA-9ppg-jx86-fqw7" ], "text": "Unauthorized npm publish of Cline CLI cline@2.3.0 with modified postinstall script to install openclaw" }, { "id": "GHSA-8pcm-8jpx-hv8r", "cve": "CVE-2026-26268", "date": "2026-02-13", "updated": "2026-03-16", "title": "Sandbox escape via Git hooks", "severity": "high", "cvss": 8.0, "tools": [ "cursor" ], "component": "Cursor", "kind": "cve", "repo": "cursor/cursor", "affected": "<2.5", "patched": "2.5", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-8pcm-8jpx-hv8r" ], "text": "Sandbox escape via Git hooks" }, { "id": "GHSA-f2g4-87h6-4pxq", "cve": "CVE-2026-25805", "date": "2026-02-10", "updated": "2026-02-10", "title": "Parameter Values are not shown for MCP Tool Calls. Users cannot detect tool poisoning.", "severity": "medium", "cvss": 6.4, "tools": [ "zed" ], "component": "Zed", "kind": "cve", "repo": "zed-industries/zed", "affected": "0.217.3", "patched": "0.219.4", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/zed-industries/zed/security/advisories/GHSA-f2g4-87h6-4pxq" ], "text": "Parameter Values are not shown for MCP Tool Calls. Users cannot detect tool poisoning." }, { "id": "GHSA-6xq8-9qf3-p6qv", "cve": "CVE-2026-21518", "date": "2026-02-10", "updated": "2026-02-10", "title": "Workspace trust for MCP servers", "severity": "low", "cvss": null, "tools": [ "copilot" ], "component": "VS Code (Copilot Chat / MCP)", "kind": "cve", "repo": "microsoft/vscode", "affected": "<1.109.1", "patched": "1.109.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/microsoft/vscode/security/advisories/GHSA-6xq8-9qf3-p6qv" ], "text": "Workspace trust for MCP servers" }, { "id": "GHSA-mhg7-666j-cqg4", "cve": "CVE-2026-25723", "date": "2026-02-06", "updated": "2026-02-06", "title": "Command Injection via Piped sed Command Bypasses File Write Restrictions", "severity": "high", "cvss": 7.7, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< v2.0.55", "patched": "v2.0.55", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-mhg7-666j-cqg4" ], "text": "Command Injection via Piped sed Command Bypasses File Write Restrictions" }, { "id": "GHSA-ff64-7w26-62rf", "cve": "CVE-2026-25725", "date": "2026-02-06", "updated": "2026-02-06", "title": "Sandbox Escape via Persistent Configuration Injection in settings.json", "severity": "high", "cvss": 7.7, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< v2.1.2", "patched": "v2.1.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-ff64-7w26-62rf" ], "text": "Sandbox Escape via Persistent Configuration Injection in settings.json" }, { "id": "GHSA-66q4-vfjg-2qhh", "cve": "CVE-2026-25722", "date": "2026-02-06", "updated": "2026-02-06", "title": "Command Injection via Directory Change Bypasses Write Protection", "severity": "high", "cvss": 7.7, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< v2.0.57", "patched": "v2.0.57", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-66q4-vfjg-2qhh" ], "text": "Command Injection via Directory Change Bypasses Write Protection" }, { "id": "GHSA-4q92-rfm6-2cqx", "cve": "CVE-2026-25724", "date": "2026-02-06", "updated": "2026-02-06", "title": "Permission Deny Bypass Through Symbolic Links", "severity": "low", "cvss": 2.3, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< v2.1.7", "patched": "v2.1.7", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-4q92-rfm6-2cqx" ], "text": "Permission Deny Bypass Through Symbolic Links" }, { "id": "GHSA-345p-7cg4-v4c7", "cve": "CVE-2026-25536", "date": "2026-02-04", "updated": "2026-02-09", "title": "Sharing server/transport instances can leak cross-client response data", "severity": "high", "cvss": 7.1, "tools": [ "mcp-protocol" ], "component": "MCP TypeScript SDK", "kind": "cve", "repo": "modelcontextprotocol/typescript-sdk", "affected": ">= 1.10.0, <= 1.25.3", "patched": "1.26.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-345p-7cg4-v4c7" ], "text": "Sharing server/transport instances can leak cross-client response data" }, { "id": "GHSA-vhw5-3g5m-8ggf", "cve": "CVE-2026-24052", "date": "2026-02-03", "updated": "2026-02-03", "title": "Domain Validation Bypass Allows Automatic Requests to Attacker-Controlled Domains", "severity": "high", "cvss": 7.1, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< v1.0.111", "patched": "v1.0.111", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-vhw5-3g5m-8ggf" ], "text": "Domain Validation Bypass Allows Automatic Requests to Attacker-Controlled Domains" }, { "id": "GHSA-qgqw-h4xq-7w8w", "cve": "CVE-2026-24887", "date": "2026-02-03", "updated": "2026-02-03", "title": "Command Injection in find Command Bypasses User Approval Prompt", "severity": "high", "cvss": 7.7, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< v2.0.72", "patched": "v2.0.72", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-qgqw-h4xq-7w8w" ], "text": "Command Injection in find Command Bypasses User Approval Prompt" }, { "id": "GHSA-q728-gf8j-w49r", "cve": "CVE-2026-24053", "date": "2026-02-03", "updated": "2026-02-03", "title": "Path Restriction Bypass via ZSH Clobber Allows Arbitrary File Writes", "severity": "high", "cvss": 7.7, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< v2.0.74", "patched": "v2.0.74", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-q728-gf8j-w49r" ], "text": "Path Restriction Bypass via ZSH Clobber Allows Arbitrary File Writes" }, { "id": "GHSA-jh7p-qr78-84p7", "cve": "CVE-2026-21852", "date": "2026-01-20", "updated": "2026-01-20", "title": "Malicious repo configuration can trigger data leakage via environment configuration used before trust confirmation", "severity": "medium", "cvss": 5.3, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "< v2.0.65", "patched": "v2.0.65", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-jh7p-qr78-84p7" ], "text": "Malicious repo configuration can trigger data leakage via environment configuration used before trust confirmation" }, { "id": "GHSA-82wg-qcm4-fp2w", "cve": "CVE-2026-22708", "date": "2026-01-14", "updated": "2026-01-14", "title": "Terminal Tool Allowlist Bypass via Environment Variables", "severity": "high", "cvss": null, "tools": [ "cursor" ], "component": "Cursor", "kind": "cve", "repo": "cursor/cursor", "affected": "<= 2.2", "patched": "2.3", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-82wg-qcm4-fp2w" ], "text": "Terminal Tool Allowlist Bypass via Environment Variables" }, { "id": "GHSA-cqwc-fm46-7fff", "cve": "CVE-2026-0621", "date": "2026-01-07", "updated": "2026-01-07", "title": "Regular Expression Denial of Service (ReDoS) in UriTemplate", "severity": "high", "cvss": null, "tools": [ "mcp-protocol" ], "component": "MCP TypeScript SDK", "kind": "cve", "repo": "modelcontextprotocol/typescript-sdk", "affected": "<1.25.2", "patched": "1.25.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-cqwc-fm46-7fff" ], "text": "Regular Expression Denial of Service (ReDoS) in UriTemplate" }, { "id": "GHSA-8r9q-7v3j-jr4g", "cve": "CVE-2026-0621", "date": "2026-01-05", "updated": "2026-07-15", "title": "Anthropic's MCP TypeScript SDK has a ReDoS vulnerability", "severity": "high", "cvss": 8.7, "tools": [ "mcp-protocol" ], "component": "MCP TypeScript SDK", "kind": "cve", "repo": "modelcontextprotocol/typescript-sdk", "affected": ">= 1.3.0, < 1.25.2", "patched": "1.25.2", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/advisories/GHSA-8r9q-7v3j-jr4g" ], "text": "Anthropic's MCP TypeScript SDK has a ReDoS vulnerability" }, { "id": "GHSA-j22h-9j4x-23w5", "cve": "CVE-2025-68145", "date": "2025-12-17", "updated": "2025-12-18", "title": "Missing path validation when using --repository flag in mcp-server-git", "severity": "medium", "cvss": 6.4, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "cve", "repo": "modelcontextprotocol/servers", "affected": "< 2025.12.18", "patched": "2025.12.18", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-j22h-9j4x-23w5" ], "text": "Missing path validation when using --repository flag in mcp-server-git" }, { "id": "GHSA-cv6g-cmxc-vw8j", "cve": "CVE-2025-68433", "date": "2025-12-17", "updated": "2025-12-17", "title": "Zed IDE MCP Context Server Configuration Arbitrary Code Execution", "severity": "high", "cvss": 7.7, "tools": [ "zed" ], "component": "Zed", "kind": "cve", "repo": "zed-industries/zed", "affected": "< v0.218.2-pre (including current stable release v0.217.2)", "patched": "v0.218.2-pre", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/zed-industries/zed/security/advisories/GHSA-cv6g-cmxc-vw8j" ], "text": "Zed IDE MCP Context Server Configuration Arbitrary Code Execution" }, { "id": "GHSA-9xwc-hfwc-8w59", "cve": "CVE-2025-68144", "date": "2025-12-17", "updated": "2025-12-18", "title": "Argument injection in git_diff and git_checkout functions for mcp-server-git allows overwriting local files", "severity": "medium", "cvss": 6.3, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "cve", "repo": "modelcontextprotocol/servers", "affected": "< 2025.12.18", "patched": "2025.12.18", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-9xwc-hfwc-8w59" ], "text": "Argument injection in git_diff and git_checkout functions for mcp-server-git allows overwriting local files" }, { "id": "GHSA-5cgr-j3jf-jw3v", "cve": "CVE-2025-68143", "date": "2025-12-17", "updated": "2025-12-17", "title": "Unrestricted git_init tool allows repository creation at arbitrary filesystem locations in mcp-server-git", "severity": "medium", "cvss": 6.5, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "cve", "repo": "modelcontextprotocol/servers", "affected": "< 2025.9.25", "patched": "2025.9.25", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-5cgr-j3jf-jw3v" ], "text": "Unrestricted git_init tool allows repository creation at arbitrary filesystem locations in mcp-server-git" }, { "id": "GHSA-29cp-2hmh-hcxj", "cve": "CVE-2025-68432", "date": "2025-12-17", "updated": "2025-12-17", "title": "Zed IDE LSP Binary Configuration Arbitrary Code Execution", "severity": "high", "cvss": 7.7, "tools": [ "zed" ], "component": "Zed", "kind": "cve", "repo": "zed-industries/zed", "affected": "< v0.218.2-pre (including current stable release v0.217.2)", "patched": "v0.218.2-pre", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/zed-industries/zed/security/advisories/GHSA-29cp-2hmh-hcxj" ], "text": "Zed IDE LSP Binary Configuration Arbitrary Code Execution" }, { "id": "GHSA-xq4m-mc3c-vvg3", "cve": "CVE-2025-66032", "date": "2025-12-03", "updated": "2025-12-03", "title": "Command Validation Bypass Allows Arbitrary Code Execution", "severity": "high", "cvss": 8.7, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "= 0.0.5, < 0.1.16", "patched": "0.1.16", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/advisories/GHSA-6xpm-ggf7-wc3p" ], "text": "mcp-remote exposed to OS command injection via untrusted MCP server connections" }, { "id": "GHSA-3765-5vjr-qjgm", "cve": "CVE-2025-53536", "date": "2025-07-07", "updated": "2025-07-07", "title": "Potential Remote Code Execution via .vscode/settings.json in the Roo Code extension", "severity": "high", "cvss": 8.1, "tools": [ "roo-code" ], "component": "Roo Code", "kind": "cve", "repo": "RooCodeInc/Roo-Code", "affected": "< 3.22.6", "patched": "3.22.6", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-3765-5vjr-qjgm" ], "text": "Potential Remote Code Execution via .vscode/settings.json in the Roo Code extension" }, { "id": "GHSA-j975-95f5-7wqh", "cve": "CVE-2025-53365", "date": "2025-07-04", "updated": "2025-07-04", "title": "Unhandled Exception in Streamable HTTP Transport Leading to Denial of Service", "severity": "high", "cvss": 8.7, "tools": [ "mcp-protocol" ], "component": "MCP Python SDK", "kind": "cve", "repo": "modelcontextprotocol/python-sdk", "affected": "< 1.10.0", "patched": "1.10.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-j975-95f5-7wqh" ], "text": "Unhandled Exception in Streamable HTTP Transport Leading to Denial of Service" }, { "id": "GHSA-3qhf-m339-9g5v", "cve": "CVE-2025-53366", "date": "2025-07-04", "updated": "2025-07-04", "title": "MCP SDK FastMCP Server Validation Error Leading to Denial of Service", "severity": "high", "cvss": 8.7, "tools": [ "mcp-protocol" ], "component": "MCP Python SDK", "kind": "cve", "repo": "modelcontextprotocol/python-sdk", "affected": "< 1.9.4", "patched": "1.9.4", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-3qhf-m339-9g5v" ], "text": "MCP SDK FastMCP Server Validation Error Leading to Denial of Service" }, { "id": "GHSA-q66q-fx2p-7w4m", "cve": "CVE-2025-53109", "date": "2025-07-01", "updated": "2025-07-01", "title": "Path validation bypass via symlink handling", "severity": "high", "cvss": 8.4, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "cve", "repo": "modelcontextprotocol/servers", "affected": "< 0.6.3, < 2025.3.28", "patched": "0.6.3, 2025.7.01", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-q66q-fx2p-7w4m" ], "text": "Path validation bypass via symlink handling" }, { "id": "GHSA-hc55-p739-j48w", "cve": "CVE-2025-53110", "date": "2025-07-01", "updated": "2025-07-01", "title": "Path validation bypass via colliding path prefix", "severity": "high", "cvss": 7.3, "tools": [ "mcp-protocol" ], "component": "MCP reference servers", "kind": "cve", "repo": "modelcontextprotocol/servers", "affected": "< 0.6.3, < 2025.3.28", "patched": "0.6.3, 2025.7.01", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-hc55-p739-j48w" ], "text": "Path validation bypass via colliding path prefix" }, { "id": "GHSA-wr2q-46pg-f228", "cve": "CVE-2025-53097", "date": "2025-06-27", "updated": "2025-06-27", "title": "Potential Information Leakage via JSON Schema in the Roo Code extension", "severity": "medium", "cvss": 5.9, "tools": [ "roo-code" ], "component": "Roo Code", "kind": "cve", "repo": "RooCodeInc/Roo-Code", "affected": "< 3.20.3", "patched": "3.20.3", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-wr2q-46pg-f228" ], "text": "Potential Information Leakage via JSON Schema in the Roo Code extension" }, { "id": "GHSA-5x8h-m52g-5v54", "cve": "CVE-2025-53098", "date": "2025-06-27", "updated": "2025-07-07", "title": "Potential Remote Code Execution via Model Context Protocol in the Roo Code extension", "severity": "high", "cvss": 8.1, "tools": [ "roo-code" ], "component": "Roo Code", "kind": "cve", "repo": "RooCodeInc/Roo-Code", "affected": "< 3.20.3", "patched": "3.20.3", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-5x8h-m52g-5v54" ], "text": "Potential Remote Code Execution via Model Context Protocol in the Roo Code extension" }, { "id": "GHSA-9f65-56v6-gxw7", "cve": "CVE-2025-52882", "date": "2025-06-23", "updated": "2025-06-24", "title": "Claude Code IDE extensions allow websocket connections from arbitrary origins", "severity": "high", "cvss": 8.8, "tools": [ "claude-code" ], "component": "Claude Code", "kind": "cve", "repo": "anthropics/claude-code", "affected": "> 0.2.116 < 1.0.24, > 0.2.116 < 1.0.24, > 0.1.1 [Beta] < 0.1.9 [Beta]", "patched": "1.0.24 and above, 1.0.24 and above, 0.1.9 [Beta] and above", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-9f65-56v6-gxw7" ], "text": "Claude Code IDE extensions allow websocket connections from arbitrary origins" }, { "id": "GHSA-rjmc-526x-8653", "cve": null, "date": "2025-06-19", "updated": "2025-06-19", "title": "IDOR in Usage Events API Lets Users Access Teammates' Activity Data", "severity": "medium", "cvss": 4.3, "tools": [ "cursor" ], "component": "Cursor", "kind": "ghsa", "repo": "cursor/cursor", "affected": "< 2025-06-17", "patched": "2025-06-17", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-rjmc-526x-8653" ], "text": "IDOR in Usage Events API Lets Users Access Teammates' Activity Data" }, { "id": "GHSA-c43p-6fv2-6gr2", "cve": null, "date": "2025-06-19", "updated": "2025-06-19", "title": "IDOR in Usage API Leading to Unauthorized Data Exposure", "severity": "medium", "cvss": 4.3, "tools": [ "cursor" ], "component": "Cursor", "kind": "ghsa", "repo": "cursor/cursor", "affected": "< 2025-06-17", "patched": "2025-06-17", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-c43p-6fv2-6gr2" ], "text": "IDOR in Usage API Leading to Unauthorized Data Exposure" }, { "id": "GHSA-7f8r-222p-6f5g", "cve": "CVE-2025-49596", "date": "2025-06-13", "updated": "2025-06-13", "title": "Inspector proxy server vulnerabilities", "severity": "critical", "cvss": 9.4, "tools": [ "mcp-protocol" ], "component": "MCP Inspector", "kind": "cve", "repo": "modelcontextprotocol/inspector", "affected": "< 0.14.1", "patched": "0.14.1", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g" ], "text": "Inspector proxy server vulnerabilities" }, { "id": "GHSA-9h3v-h59j-v6rj", "cve": "CVE-2025-49150", "date": "2025-06-11", "updated": "2025-06-11", "title": "Potential Information Leakage using JSON schema in Cursor Agent", "severity": "medium", "cvss": 5.9, "tools": [ "cursor" ], "component": "Cursor", "kind": "cve", "repo": "cursor/cursor", "affected": "<0.51.0", "patched": "0.51.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-9h3v-h59j-v6rj" ], "text": "Potential Information Leakage using JSON schema in Cursor Agent" }, { "id": "github-mcp-toxic-flow-2025", "date": "2025-05-26", "title": "GitHub MCP prompt injection leaks private repos via a malicious public issue", "severity": "not rated", "cvss": null, "cve": null, "status": "research", "tools": [ "copilot", "mcp-protocol" ], "component": "GitHub MCP server + any agent", "kind": "research", "text": "Invariant Labs showed an agent with a broad GitHub token reading a malicious issue and leaking private repo data into a public PR. It's an agent-design issue with no single patch.", "sources": [ "https://invariantlabs.ai/blog/mcp-github-vulnerability" ], "type": "incident", "affected": null, "patched": null, "repo": null, "updated": "2025-05-26" }, { "id": "GHSA-qjh8-mh96-fc86", "cve": "CVE-2025-32018", "date": "2025-04-07", "updated": "2025-04-07", "title": "Arbitrary file write from Cursor Agent through a prompt injection from malicious @Docs", "severity": "high", "cvss": 8.0, "tools": [ "cursor" ], "component": "Cursor", "kind": "cve", "repo": "cursor/cursor", "affected": "0.45.0-0.48.6", "patched": "0.48.7+", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-qjh8-mh96-fc86" ], "text": "Arbitrary file write from Cursor Agent through a prompt injection from malicious @Docs" }, { "id": "tool-poisoning-2025", "date": "2025-04-01", "title": "Tool Poisoning Attacks: hidden instructions in MCP tool descriptions", "severity": "not rated", "cvss": null, "cve": null, "status": "research", "tools": [ "mcp-protocol", "cursor", "claude" ], "component": "MCP clients", "kind": "research", "text": "Invariant Labs disclosed that hidden instructions in MCP tool descriptions can make clients exfiltrate files. Mitigations differ by client.", "sources": [ "https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks" ], "type": "incident", "affected": null, "patched": null, "repo": null, "updated": "2025-04-01" }, { "id": "GHSA-g4ff-54cv-h6f9", "cve": null, "date": "2024-11-27", "updated": "2024-11-27", "title": "Any Team Member Can Access Billing Link", "severity": "low", "cvss": null, "tools": [ "cursor" ], "component": "Cursor", "kind": "ghsa", "repo": "cursor/cursor", "affected": "< Nov 27, 2024", "patched": "All versions, post Nov 27", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-g4ff-54cv-h6f9" ], "text": "Any Team Member Can Access Billing Link" }, { "id": "GHSA-rmj9-23rg-gr67", "cve": "CVE-2024-48919", "date": "2024-10-22", "updated": "2024-10-22", "title": "RCE via Prompt Injection Into Cursor's Terminal Cmd-K", "severity": "high", "cvss": null, "tools": [ "cursor" ], "component": "Cursor", "kind": "cve", "repo": "cursor/cursor", "affected": "< Sep 27, 2024", "patched": "All versions, post Sep 27", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-rmj9-23rg-gr67" ], "text": "RCE via Prompt Injection Into Cursor's Terminal Cmd-K" }, { "id": "GHSA-x352-xv29-r74m", "cve": "CVE-2024-45599", "date": "2024-09-24", "updated": "2024-09-24", "title": "TCC Bypass in Cursor's macOS Application", "severity": "low", "cvss": 3.8, "tools": [ "cursor" ], "component": "Cursor", "kind": "cve", "repo": "cursor/cursor", "affected": "< 0.41.0", "patched": "0.41.0", "status": "patched", "type": "ghsa", "sources": [ "https://github.com/cursor/cursor/security/advisories/GHSA-x352-xv29-r74m" ], "text": "TCC Bypass in Cursor's macOS Application" } ], "changelog": [ { "date": "2026-10-25", "client": "Claude Code", "title": "Postman Desktop auto-installs Codex / Claude Code plugins and pre-trusts its own startup hook", "text": "Users report Postman's auto-existing-upgrade step installing Postman plugins into Claude Code and Codex, writing a trusted hook hash into Codex config, adding a SessionStart hook, the remote MCP server mcp.postman.com and a CLI in ~/.local/bin. Postman staff replied on Nov 3 that opt-in will be made clearer and hook approval is under review. No CVE.", "source": "https://github.com/postmanlabs/postman-app-support/issues/14370" }, { "date": "2026-10-29", "client": "Claude Code", "title": "Malicious 'Anthropic.claude-code' 2.1.312 / 2.1.313 in Cursor's extension marketplace", "text": "Cursor says two impersonating versions (Windows / macOS) attempted an SSH backdoor. Cursor removed them, shut down and rebuilt the marketplace, and rotated keys.", "source": "https://cursor.com/blog/claude-code-extension-security-notice" }, { "date": "2026-08-09", "client": "Claude Code", "title": "Shai-Hulud worm payload delivered through an official MCP Registry entry", "text": "OX Security reports a registry-listed MCP server shipping a payload that wrote malicious .vscode/settings.json and .claude/settings.json files.", "source": "https://www.ox.security/blog/shai-hulud-outbreak-debrief-the-worm-evolves-into-mcp/" }, { "date": "2026-03-16", "client": "npm @iflow-mcp/watercrawl-watercrawl-mcp 1.3.0\u20131.3.4; OpenVSX", "title": "GlassWorm wave 5: malicious MCP server on npm and 72+ fake OpenVSX extensions", "text": "Palo Alto Networks reports a malicious MCP server package (flagged Mar 12) and 72+ malicious OpenVSX extensions, some impersonating Claude Code and Codex.", "source": "https://www.paloaltonetworks.com/blog/security-operations/glassworm-wave-5-malicious-mcp-servers/" }, { "date": "2025-09-25", "client": "npm postmark-mcp 1.0.16+ (unofficial)", "title": "Malicious postmark-mcp npm package BCC'd every email to an attacker", "text": "Postmark says the package was not theirs; version 1.0.16 (released Sep 17, 2025) added a BCC to an attacker domain. Snyk tracks it as SNYK-JS-POSTMARKMCP-13052679.", "source": "https://postmarkapp.com/blog/information-regarding-malicious-postmark-mcp-package/" }, { "date": "2025-05-26", "client": "GitHub Copilot (VS Code)", "title": "GitHub MCP prompt injection leaks private repos via a malicious public issue", "text": "Invariant Labs showed an agent with a broad GitHub token reading a malicious issue and leaking private repo data into a public PR. It's an agent-design issue with no single patch.", "source": "https://invariantlabs.ai/blog/mcp-github-vulnerability" }, { "date": "2025-04-01", "client": "Claude apps (claude.ai / Desktop)", "title": "Tool Poisoning Attacks: hidden instructions in MCP tool descriptions", "text": "Invariant Labs disclosed that hidden instructions in MCP tool descriptions can make clients exfiltrate files. Mitigations differ by client.", "source": "https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks" } ] }