https://agentcve.org/Public registry of known-vulnerable AI agent configurations.2026-09-20T02:45:17.577Zhttps://agentcve.org/ACVE-2026-0007ACVE-2026-0007@2026-09-20T02:45:17.577Z2026-09-20T02:45:17.577ZGemini CLI can execute commands from repository settingshttps://agentcve.org/ACVE-2026-0004ACVE-2026-0004@2026-09-20T02:45:17.577Z2026-09-20T02:45:17.577ZClaude Code deny rules can be bypassed through symlinked toolshttps://agentcve.org/ACVE-2026-0003ACVE-2026-0003@2026-09-20T02:45:17.577Z2026-09-20T02:45:17.577ZClaude Code project permissions can select an unsafe permission modehttps://agentcve.org/ACVE-2026-0002ACVE-2026-0002@2026-09-20T02:45:17.577Z2026-09-20T02:45:17.577ZClaude Code sandbox settings can permit a sandbox escapehttps://agentcve.org/ACVE-2025-0008ACVE-2025-0008@2026-09-20T02:45:17.577Z2026-09-20T02:45:17.577ZCursor can trust a mutable project MCP configurationhttps://agentcve.org/ACVE-2025-0007ACVE-2025-0007@2026-09-20T02:45:17.577Z2026-09-20T02:45:17.577ZCodex CLI can auto-load project configurationhttps://agentcve.org/ACVE-2025-0004ACVE-2025-0004@2026-09-20T02:45:17.577Z2026-09-20T02:45:17.577ZClaude Code can traverse paths through untrusted contexthttps://agentcve.org/ACVE-2025-0003ACVE-2025-0003@2026-09-20T02:45:17.577Z2026-09-20T02:45:17.577ZMCP filesystem servers permit path traversal through symlink and calendar-version pathshttps://agentcve.org/ACVE-2025-0002ACVE-2025-0002@2026-09-20T02:45:17.577Z2026-09-20T02:45:17.577Zmcp-remote can inject operating-system commands through an untrusted URLhttps://agentcve.org/ACVE-2025-0001ACVE-2025-0001@2026-09-20T02:45:17.577Z2026-09-20T02:45:17.577ZMCP Inspector can bypass local authentication and rebind localhosthttps://agentcve.org/ACVE-2024-0001ACVE-2024-0001@2026-09-20T02:45:17.577Z2026-09-20T02:45:17.577ZOllama can traverse paths and reach code executionhttps://agentcve.org/ACVE-2026-0013ACVE-2026-0013@2026-09-19T00:00:00Z2026-09-19T00:00:00ZGemini CLI README injection can reach allowlisted toolshttps://agentcve.org/ACVE-2026-0012ACVE-2026-0012@2026-09-19T00:00:00Z2026-09-19T00:00:00ZClaude Code project hooks run automatically inside the repositoryhttps://agentcve.org/ACVE-2026-0011ACVE-2026-0011@2026-09-19T00:00:00Z2026-09-19T00:00:00ZCodex trusted root scope combined with never-approve executionhttps://agentcve.org/ACVE-2026-0010ACVE-2026-0010@2026-09-19T00:00:00Z2026-09-19T00:00:00ZHTTP MCP servers and permissive modes form an over-privileged combinationhttps://agentcve.org/ACVE-2026-0009ACVE-2026-0009@2026-09-19T00:00:00Z2026-09-19T00:00:00ZAzure MCP Server package identity and release need groundinghttps://agentcve.org/ACVE-2026-0008ACVE-2026-0008@2026-09-19T00:00:00Z2026-09-19T00:00:00ZGemini CLI yolo mode disables the tool approval boundaryhttps://agentcve.org/ACVE-2026-0006ACVE-2026-0006@2026-09-19T00:00:00Z2026-09-19T00:00:00ZCursor can execute a repository git hookhttps://agentcve.org/ACVE-2026-0005ACVE-2026-0005@2026-09-19T00:00:00Z2026-09-19T00:00:00ZCursor prompt injection can reach tools outside the intended sandboxhttps://agentcve.org/ACVE-2026-0001ACVE-2026-0001@2026-09-19T00:00:00Z2026-09-19T00:00:00ZClaude Code project settings can expose credentials through a custom base URLhttps://agentcve.org/ACVE-2025-0011ACVE-2025-0011@2026-09-19T00:00:00Z2026-09-19T00:00:00ZClaude Code IDE extension can bypass local authenticationhttps://agentcve.org/ACVE-2025-0010ACVE-2025-0010@2026-09-19T00:00:00Z2026-09-19T00:00:00ZVS Code Copilot Chat settings can auto-approve toolshttps://agentcve.org/ACVE-2025-0009ACVE-2025-0009@2026-09-19T00:00:00Z2026-09-19T00:00:00ZCursor CurXecute can inject an MCP configurationhttps://agentcve.org/ACVE-2025-0006ACVE-2025-0006@2026-09-19T00:00:00Z2026-09-19T00:00:00ZClaude Code project hooks can inject configuration and commandshttps://agentcve.org/ACVE-2025-0005ACVE-2025-0005@2026-09-19T00:00:00Z2026-09-19T00:00:00ZClaude Code can execute commands under permissive approval modes