-
Notifications
You must be signed in to change notification settings - Fork 668
Expand file tree
/
Copy paththreat-db.yaml
More file actions
3137 lines (2925 loc) · 192 KB
/
Copy paththreat-db.yaml
File metadata and controls
3137 lines (2925 loc) · 192 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# AI Agent Skills & MCP Servers - Threat Intelligence Database
# For use with /security-check and /security-audit commands
# Manually maintained — update after new security advisories
version: "2.18.0"
updated: "2026-05-16"
sources:
- name: "Snyk ToxicSkills"
url: "https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/"
date: "2026-02-05"
- name: "Koi Security ClawHavoc"
url: "https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting"
date: "2026-02-01"
- name: "SafeDep Agent Skills Threat Model"
url: "https://safedep.io/agent-skills-threat-model"
date: "2026-01"
- name: "Cymulate EscapeRoute (CVE-2025-53109/53110)"
url: "https://cymulate.com/blog/cve-2025-53109-53110-escaperoute-anthropic/"
date: "2025-09"
- name: "Checkpoint MCPoison (CVE-2025-54135/54136)"
url: "https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/"
date: "2025-10"
- name: "JFrog Prompt Hijacking (CVE-2025-6515)"
url: "https://jfrog.com/blog/mcp-prompt-hijacking-vulnerability/"
date: "2025-10"
- name: "JFrog PyPI MCP Reverse Shell"
url: "https://research.jfrog.com/post/3-malicious-mcps-pypi-reverse-shell/"
date: "2025-12"
- name: "Recorded Future MCP Inspector (CVE-2025-49596)"
url: "https://www.recordedfuture.com/blog/anthropic-mcp-inspector-cve-2025-49596"
date: "2025-07"
- name: "Flatt Security - 8 ways to pwn Claude Code"
url: "https://flatt.tech/research/posts/pwning-claude-code-in-8-different-ways/"
date: "2026-01"
- name: "SentinelOne WebFetch SSRF (CVE-2026-24052)"
url: "https://www.sentinelone.com/vulnerability-database/cve-2026-24052/"
date: "2026-01"
- name: "The Hacker News - MCP Git Server Flaws"
url: "https://thehackernews.com/2026/01/three-flaws-in-anthropic-mcp-git-server.html"
date: "2026-01"
- name: "Bitsight TRACE - Exposed MCP Servers"
url: "https://www.bitsight.com/blog/exposed-mcp-servers-reveal-new-ai-vulnerabilities"
date: "2026-01"
- name: "Defender's Initiative - Postmark MCP Squatter"
url: "https://defendersinitiative.substack.com/p/npm-not-another-package-malicious"
date: "2025-11"
- name: "SAFE-MCP Framework"
url: "https://www.safemcp.org"
date: "2026-01"
- name: "VirusTotal - OpenClaw Malicious Skills"
url: "https://blog.virustotal.com/2026/02/from-automation-to-infection-how.html"
date: "2026-02-02"
- name: "arXiv - Malicious Agent Skills Empirical Study"
url: "https://www.arxiv.org/abs/2602.06547"
date: "2026-02-06"
- name: "SentinelOne - xcode-mcp-server CVE-2026-2178"
url: "https://www.sentinelone.com/vulnerability-database/cve-2026-2178/"
date: "2026-02-13"
- name: "Immersive Labs - CVE-2026-23744 MCPJam RCE"
url: "https://community.immersivelabs.com/blog/the-human-connection-blog/new-cti-lab-cve-2026-23744-mcpjam-rce-offensive/3882"
date: "2026-01-21"
- name: "Aikido - Hallucinated npx Commands in Skills"
url: "https://www.aikido.dev/blog/agent-skills-spreading-hallucinated-npx-commands"
date: "2026-01-21"
- name: "OWASP Top 10 for Agentic AI Security Risks 2026"
url: "https://www.startupdefense.io/blog/owasp-top-10-agentic-ai-security-risks-2026"
date: "2026-02-16"
- name: "Lakera - The Agent Skill Ecosystem: When AI Extensions Become a Malware Delivery Channel"
url: "https://www.lakera.ai/blog/the-agent-skill-ecosystem-when-ai-extensions-become-a-malware-delivery-channel"
date: "2026-02-20"
- name: "Penligent AI - CVE-2026-0755 gemini-mcp-tool Command Injection"
url: "https://www.penligent.ai/hackinglabs/de/deep-analysis-of-gemini-mcp-tool-command-injection-cve-2026-0755-when-an-mcp-toolchain-hands-user-input-to-the-shell/"
date: "2026-02-07"
- name: "Snyk - SSRF in mcp-run-python (SNYK-PYTHON-MCPRUNPYTHON-15250607)"
url: "https://security.snyk.io/vuln/SNYK-PYTHON-MCPRUNPYTHON-15250607"
date: "2026-02-09"
- name: "The Hacker News - Anthropic Launches Claude Code Security"
url: "https://thehackernews.com/2026/02/anthropic-launches-claude-code-security.html"
date: "2026-02-21"
- name: "Check Point Research - CVE-2025-59536 & CVE-2026-21852 Claude Code RCE + API Key Theft"
url: "https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/"
date: "2026-02-25"
- name: "The Hacker News - Claude Code Flaws Allow RCE and API Key Theft"
url: "https://thehackernews.com/2026/02/claude-code-flaws-allow-remote-code.html"
date: "2026-02-25"
- name: "Trend Micro - Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer"
url: "https://www.trendmicro.com/en_us/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html"
date: "2026-02-23"
- name: "1Password - From magic to malware: OpenClaw attack surface"
url: "https://1password.com/blog/from-magic-to-malware-how-openclaws-agent-skills-become-an-attack-surface"
date: "2026-02-02"
- name: "Red Hat - MCP Security Current Situation"
url: "https://www.redhat.com/en/blog/mcp-security-current-situation"
date: "2026-02-25"
- name: "NVD - CVE-2026-26029 sf-mcp-server Command Injection"
url: "https://nvd.nist.gov/vuln/detail/CVE-2026-26029"
date: "2026-02-11"
- name: "CVEDetails - CVE-2026-27203 eBay API MCP Server Env Injection"
url: "https://www.cvedetails.com/cve/CVE-2026-27203/"
date: "2026-02-20"
- name: "NVD - CVE-2026-27735 mcp-server-git Path Traversal in git_add"
url: "https://nvd.nist.gov/vuln/detail/CVE-2026-27735"
date: "2026-02-26"
- name: "Snyk - Clinejection: AI Bot → Supply Chain Attack via Cache Poisoning"
url: "https://snyk.io/blog/cline-supply-chain-attack-prompt-injection-github-actions/"
date: "2026-02-19"
- name: "The Hacker News - Cline CLI 2.3.0 Supply Chain Attack"
url: "https://thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html"
date: "2026-02-20"
- name: "Microsoft Security Blog - AI Recommendation Poisoning"
url: "https://www.microsoft.com/en-us/security/blog/2026/02/10/ai-recommendation-poisoning/"
date: "2026-02-10"
- name: "SonicWall - CVE-2026-25253 OpenClaw Auth Token Theft RCE"
url: "https://www.sonicwall.com/blog/openclaw-auth-token-theft-leading-to-rce-cve-2026-25253"
date: "2026-02-26"
- name: "Hunt.io - CVE-2026-25253 17500+ Exposed OpenClaw Instances"
url: "https://hunt.io/blog/cve-2026-25253-openclaw-ai-agent-exposure"
date: "2026-02-03"
- name: "NVD - CVE-2026-25725 Claude Code Sandbox Escape"
url: "https://nvd.nist.gov/vuln/detail/CVE-2026-25725"
date: "2026-02-06"
- name: "NVD - CVE-2026-0757 MCP Manager Claude Desktop Sandbox Escape"
url: "https://nvd.nist.gov/vuln/detail/CVE-2026-0757"
date: "2026-01-22"
- name: "ZDI - CVE-2025-15061 Framelink Figma MCP Server fetchWithRetry RCE"
url: "https://www.zerodayinitiative.com/advisories/ZDI-25-1197/"
date: "2025-12-29"
- name: "Check Point Advisories - CVE-2025-35028 HexStrike AI MCP Server"
url: "https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2025-12521.html"
date: "2026-03-02"
- name: "Oasis Security - ClawJacked OpenClaw WebSocket Hijack"
url: "https://www.oasis.security/blog/openclaw-vulnerability"
date: "2026-02-26"
- name: "THN - ClawJacked + 71 Malicious ClawHub Skills"
url: "https://thehackernews.com/2026/02/clawjacked-flaw-lets-malicious-sites.html"
date: "2026-02-28"
- name: "NVD - CVE-2026-3484 Nmap-Mcp-Server Command Injection"
url: "https://nvd.nist.gov/vuln/detail/CVE-2026-3484"
date: "2026-03-04"
- name: "Ona Security - Claude Code Autonomous Denylist and Sandbox Bypass"
url: "https://ona.com/stories/how-claude-code-escapes-its-own-denylist-and-sandbox"
date: "2026-03-03"
- name: "Brandefense - MCP Server Security: 10 Protocol-Level Attack Scenarios"
url: "https://brandefense.io/blog/mcp-server-security-protocol-attack-patterns/"
date: "2026-03-02"
- name: "THN / Tenable - CVE-2026-26118 Azure MCP Server SSRF"
url: "https://thehackernews.com/2026/03/microsoft-patches-84-flaws-in-march.html"
date: "2026-03-11"
- name: "ReversingLabs - OpenClaw and agentic AI risk: 3 application security lessons"
url: "https://www.reversinglabs.com/blog/openclaw-agentic-ai-risk"
date: "2026-03-10"
- name: "GitHub Security Lab - Taskflow Agent open-source vulnerability scanner"
url: "https://github.blog/security/how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework/"
date: "2026-03-06"
- name: "OpenAI - Codex Security research preview"
url: "https://openai.com/index/codex-security-now-in-research-preview/"
date: "2026-03-05"
- name: "DryRun Security - AI coding agents introduce vulnerabilities in 87% of PRs"
url: "https://markets.businessinsider.com/news/stocks/new-dryrun-security-research-anthropic-s-claude-generates-the-most-unresolved-security-flaws-in-ai-built-applications-1035918593"
date: "2026-03-11"
- name: "The Hacker News - GhostClaw npm Package Deploys RAT"
url: "https://thehackernews.com/2026/03/malicious-npm-package-posing-as.html"
date: "2026-03-09"
- name: "Huntress / itbrew - Fake OpenClaw Installer Stealth Packer + GhostSocks"
url: "https://www.itbrew.com/stories/2026/03/03/new-vulnerability-in-open-source-repositories-uses-fake-openclaw-install-to-attack"
date: "2026-03-03"
- name: "Jozu Agent Guard - Zero-Trust AI Runtime"
url: "https://www.helpnetsecurity.com/2026/03/17/jozu-agent-guard-targets-ai-agents-that-evade-controls/"
date: "2026-03-17"
- name: "GitHub Blog - Secret Scanning via GitHub MCP Server (public preview)"
url: "https://github.blog/changelog/2026-03-17-secret-scanning-in-ai-coding-agents-via-the-github-mcp-server/"
date: "2026-03-17"
- name: "SC World - Shadow MCP: The New Security Risk of Unvetted AI Agent Tools"
url: "https://www.scworld.com/perspective/mcp-is-the-backdoor-your-zero-trust-architecture-forgot-to-close"
date: "2026-03-18"
- name: "AdminByRequest - OpenClaw Security Crisis Overview"
url: "https://www.adminbyrequest.com/en/blogs/openclaw-went-from-viral-ai-agent-to-security-crisis-in-just-three-weeks"
date: "2026-03-09"
- name: "Intel471 - OpenClaw ClickFix Infostealer Campaign"
url: "https://www.intel471.com/blog/openclaw-a-viral-ai-assistant-and-a-magnet-for-infostealer-malware-and-clickfix-trickery"
date: "2026-03-12"
- name: "Reco.ai - OpenClaw Security Crisis Unfolding"
url: "https://www.reco.ai/blog/openclaw-the-ai-agent-security-crisis-unfolding-right-now"
date: "2026-03-20"
- name: "Particula.tech - OpenClaw 250K Stars / 20% Malicious Skills"
url: "https://particula.tech/blog/openclaw-security-crisis-malicious-ai-agents"
date: "2026-03-15"
- name: "Dark Reading - MCP Security Cannot Be Patched Away (RSAC 2026)"
url: "https://www.darkreading.com/application-security/mcp-security-patched"
date: "2026-03-19"
- name: "SentinelOne - CVE-2026-4192 quip-mcp-server RCE"
url: "https://www.sentinelone.com/vulnerability-database/cve-2026-4192/"
date: "2026-03-19"
- name: "SentinelOne - CVE-2026-4270 AWS API MCP Server Path Traversal"
url: "https://www.sentinelone.com/vulnerability-database/cve-2026-4270/"
date: "2026-03-19"
- name: "Miggo.io - CVE-2026-33252 MCP Go SDK CSRF"
url: "https://www.miggo.io/vulnerability-database/cve/CVE-2026-33252"
date: "2026-03-22"
- name: "Miggo.io - CVE-2026-27826 MCP Atlassian SSRF"
url: "https://www.miggo.io/vulnerability-database/cve/CVE-2026-27826"
date: "2026-03-11"
- name: "Rogue Security - 30 CVEs in 60 Days MCP Security Reckoning"
url: "https://www.rogue.security/blog/30-cves-60-days-mcp-security-reckoning"
date: "2026-03-23"
- name: "Silverfort - ClawHub Ranking Manipulation Vulnerability"
url: "https://www.silverfort.com/blog/clawhub-vulnerability-enables-attackers-to-manipulate-rankings-to-become-the-number-one-skill/"
date: "2026-03-24"
- name: "Cisco DefenseClaw - Open Source Secure Agent Framework"
url: "https://newsroom.cisco.com/content/r/newsroom/en/us/a/y2026/m03/cisco-reimagines-security-for-the-agentic-workforce.html"
date: "2026-03-23"
- name: "SentinelOne - CVE-2025-59834 ADB MCP Server RCE"
url: "https://www.sentinelone.com/vulnerability-database/cve-2025-59834/"
date: "2025-09-25"
- name: "Cloud Security Alliance - MCP Authentication Vacuum"
url: "https://cloudsecurityalliance.org/blog/2026/03/24/the-agentic-trust-deficit-why-mcp-s-authentication-vacuum-demands-a-new-security-paradigm"
date: "2026-03-24"
- name: "CrowdStrike - Agentic Tool Chain Attacks"
url: "https://www.crowdstrike.com/en-us/blog/how-agentic-tool-chain-attacks-threaten-ai-agent-security/"
date: "2026-03-25"
- name: "SentinelOne - CVE-2026-33010 mcp-memory-service CORS"
url: "https://www.sentinelone.com/vulnerability-database/cve-2026-33010/"
date: "2026-03-27"
- name: "integsec.com - CVE-2026-33010 Cross-Origin Memory Theft"
url: "https://integsec.com/blog/cve-2026-33010-mcp-memory-service-cross-origin-memory-theft-what-it-means-for-your-business-and-how-to-respond"
date: "2026-03-27"
- name: "Tenable - CVE-2026-33946 MCP Ruby SDK Session Hijacking"
url: "https://www.tenable.com/cve/CVE-2026-33946"
date: "2026-03-27"
- name: "radar.offseq.com - CVE-2026-27597 agentfront enclave Sandbox Escape"
url: "https://radar.offseq.com/threat/cve-2026-27597-cwe-94-improper-control-of-generati-c298fcde"
date: "2026-03-28"
- name: "The Hacker News - IDEsaster: 30+ Flaws in AI Coding Tools"
url: "https://radar.offseq.com/threat/researchers-uncover-30-flaws-in-ai-coding-tools-en-5c971663"
date: "2026-03-29"
- name: "ZDI-26-246 - CVE-2026-5058 aws-mcp-server 0-day Command Injection"
url: "https://www.zerodayinitiative.com/advisories/ZDI-26-246/"
date: "2026-03-30"
- name: "SentinelOne - CVE-2026-31951 LibreChat OAuth Token Exfiltration"
url: "https://www.sentinelone.com/vulnerability-database/cve-2026-31951/"
date: "2026-04-03"
- name: "NVD - CVE-2026-34742 Go MCP SDK DNS Rebinding"
url: "https://nvd.nist.gov/vuln/detail/CVE-2026-34742"
date: "2026-04-02"
- name: "Tenable - CVE-2026-5323 a11y-mcp SSRF"
url: "https://www.tenable.com/cve/CVE-2026-5323"
date: "2026-04-02"
- name: "ThreatDown - Weaponizing Autonomy: The Rise of Malicious AI Agent Skills"
url: "https://www.threatdown.com/blog/weaponizing-autonomy-the-rise-of-malicious-ai-agent-skills/"
date: "2026-04-04"
- name: "Straiker.ai - NomShub: Cursor Remote Tunnel Exploitation via Indirect Prompt Injection"
url: "https://www.straiker.ai/blog/nomshub-cursor-remote-tunneling-sandbox-breakout"
date: "2026-04-03"
- name: "arXiv 2604.03070 - Credential Leakage in LLM Agent Skills: Large-Scale Empirical Study"
url: "https://arxiv.org/html/2604.03070v1"
date: "2026-04-03"
- name: "Permiso - SandyClaw: First Dynamic Sandbox for AI Agent Skills"
url: "https://permiso.io/blog/introducing-sandyclaw-dynamic-sandbox-ai-agent-skills"
date: "2026-04-03"
- name: "arXiv 2604.06550 - Hierarchical Triage Framework for Detecting Malicious AI Agent Skills"
url: "https://arxiv.org/html/2604.06550v1"
date: "2026-04-09"
- name: "arXiv 2604.04759 - A Real-World Safety Analysis of OpenClaw"
url: "https://arxiv.org/html/2604.04759"
date: "2026-04-07"
- name: "NVD - CVE-2026-35577 Apollo MCP Server DNS Rebinding"
url: "https://nvd.nist.gov/vuln/detail/CVE-2026-35577"
date: "2026-04-10"
- name: "runZero - CVE-2026-5374 runZero Platform MCP Info Leak"
url: "https://www.runzero.com/advisories/runzero-platform-mcp-infoleak-cve-2026-5374/"
date: "2026-04-07"
- name: "NVD - CVE-2026-5833 mcp-server-taskwarrior Command Injection"
url: "https://nvd.nist.gov/vuln/detail/CVE-2026-5833"
date: "2026-04-09"
- name: "CVEDetails - CVE-2026-5619 Braffolk mcp-summarization-functions"
url: "https://www.cvedetails.com/cve/CVE-2026-5619/"
date: "2026-04-06"
- name: "CVE.org - CVE-2026-39974 n8n-MCP Vulnerability"
url: "https://www.cve.org/CVERecord?id=CVE-2026-39974"
date: "2026-04-09"
- name: "Red Hat - CVE-2026-27124 FastMCP OAuthProxy OAuth Validation Flaw"
url: "https://access.redhat.com/security/cve/cve-2026-27124"
date: "2026-04-06"
- name: "AccuKnox - ClawArmor for OpenClaw Security"
url: "https://accuknox.com/blog/introducing-clawarmor-for-openclaw-instances"
date: "2026-04-07"
- name: "prompt-security/ClawSec - Security Skill Suite for AI Agent Platforms"
url: "https://github.com/prompt-security/clawsec"
date: "2026-04-10"
- name: "Praetorian - Indirect Prompt Injection: The LLM Supervisor Blind Spot"
url: "https://www.praetorian.com/blog/indirect-prompt-injection-llm/"
date: "2026-04-10"
- name: "Pluto Security / Rapid7 - CVE-2026-33032 MCPwn nginx-ui Authentication Bypass"
url: "https://www.rapid7.com/blog/post/etr-cve-2026-33032-nginx-ui-missing-mcp-authentication/"
date: "2026-04-16"
- name: "Picus Security - CVE-2026-33032 MCPwn Full Analysis"
url: "https://www.picussecurity.com/resource/blog/cve-2026-33032-mcpwn-how-a-missing-middleware-call-in-nginx-ui-hands-attackers-full-web-server-takeover"
date: "2026-04-16"
- name: "OX Security - The Mother of All AI Supply Chains: MCP STDIO Design Flaw"
url: "https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/"
date: "2026-04-15"
- name: "The Register - MCP Design Flaw Puts 200K Servers at Risk"
url: "https://www.theregister.com/2026/04/16/anthropic_mcp_design_flaw/"
date: "2026-04-16"
- name: "OWASP GenAI Exploit Round-up Report Q1 2026"
url: "https://genai.owasp.org/2026/04/14/owasp-genai-exploit-round-up-report-q1-2026/"
date: "2026-04-15"
- name: "SecurityWeek / TechZine - Comment and Control: Claude Code, Gemini CLI, GitHub Copilot Prompt Injection"
url: "https://www.securityweek.com/claude-code-gemini-cli-github-copilot-agents-vulnerable-to-prompt-injection-via-comments/"
date: "2026-04-16"
- name: "SentinelOne - CVE-2025-56404 MariaDB MCP Information Disclosure"
url: "https://www.sentinelone.com/vulnerability-database/cve-2025-56404/"
date: "2026-04-15"
- name: "Cequence.ai - Prompt Injection Exposes AI Agent Credentials"
url: "https://www.cequence.ai/blog/ai/even-the-best-ai-agents-leak-secrets-prompt-injection-is-why/"
date: "2026-04-16"
- name: "SecurityWeek - Cursor AI Vulnerability Exposed Developer Devices (NomShub full coverage)"
url: "https://www.securityweek.com/cursor-ai-vulnerability-exposed-developer-devices/"
date: "2026-04-17"
- name: "THN - Anthropic MCP Design Vulnerability Enables RCE (7000+ servers, 150M downloads)"
url: "https://thehackernews.com/2026/04/anthropic-mcp-design-vulnerability.html"
date: "2026-04-20"
- name: "Red Hat - CVE-2026-6494 AAP MCP Server Log Injection"
url: "https://access.redhat.com/security/cve/cve-2026-6494"
date: "2026-04-17"
- name: "SentinelOne - CVE-2025-69256 Serverless Framework MCP RCE"
url: "https://www.sentinelone.com/vulnerability-database/cve-2025-69256/"
date: "2026-04-22"
- name: "InfoSecurity Magazine - 10 In-the-Wild Indirect Prompt Injection Payloads"
url: "https://www.infosecurity-magazine.com/news/researchers-10-wild-indirect/"
date: "2026-04-23"
- name: "Straiker - 94% of AI Agents Vulnerable to Prompt Injection (empirical study)"
url: "https://www.straiker.ai/blog/why-94-of-ai-agents-are-vulnerable-to-prompt-injection----and-what-to-do-about-it"
date: "2026-04-22"
- name: "IBM X-Force - Agentic AI is growing fast, as are the vulnerabilities"
url: "https://www.ibm.com/think/x-force/agentic-ai-growing-fast-vulnerabilities"
date: "2026-04-24"
- name: "THN - Google Patches Antigravity IDE Flaw / Claudy Day / Claude Memory Poisoning"
url: "https://thehackernews.com/2026/04/google-patches-antigravity-ide-flaw.html"
date: "2026-04-21"
- name: "Cisco - AI Agent Security Scanner for IDEs"
url: "https://blogs.cisco.com/ai/introducing-the-ai-agent-security-scanner-for-ides-verify-your-agents"
date: "2026-04-21"
- name: "SentinelOne - CVE-2026-35021 Claude Code CLI OS Command Injection"
url: "https://www.sentinelone.com/vulnerability-database/cve-2026-35021/"
date: "2026-04-10"
- name: "SentinelOne - CVE-2026-39861 Anthropic Claude Code RCE"
url: "https://www.sentinelone.com/vulnerability-database/cve-2026-39861/"
date: "2026-04-23"
- name: "Sonar - Two Critical Flaws in Claude Code CLI Allowing Arbitrary Code Execution"
url: "https://www.sonarsource.com/blog/claude-arbitrary-code-execution"
date: "2026-04-30"
- name: "Trend Micro - Exposed MCP Servers Widen to Cloud Attack Surface"
url: "https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/update-on-exposed-mcp-servers-the-threat-widens-to-the-cloud"
date: "2026-04-28"
- name: "The Register - 30 ClawHub Skills Secretly Turn AI Agents into Crypto Swarm"
url: "https://www.theregister.com/2026/04/29/30_clawhub_skills_mine_crypto/"
date: "2026-04-29"
- name: "Acronis - AI Supply Chain Attacks on Hugging Face and OpenClaw"
url: "https://www.acronis.com/en/tru/posts/poisoning-the-well-ai-supply-chain-attacks-on-hugging-face-and-openclaw/"
date: "2026-04-30"
- name: "SecurityWeek - Hugging Face and ClawHub Abused for Malware Distribution via Indirect Prompt Injection"
url: "https://www.securityweek.com/hugging-face-clawhub-abused-for-malware-distribution/"
date: "2026-05-01"
- name: "Red Hat - CVE-2026-30625 Upsonic MCP Server RCE"
url: "https://access.redhat.com/security/cve/cve-2026-30625"
date: "2026-04-16"
- name: "NVD - CVE-2026-7593 Sunwood-ai-labs command-executor-mcp-server Command Injection"
url: "https://nvd.nist.gov/vuln/detail/CVE-2026-7593"
date: "2026-05-01"
- name: "NVD - CVE-2026-7591 TimBroddin astro-mcp-server Vulnerability"
url: "https://nvd.nist.gov/vuln/detail/CVE-2026-7591"
date: "2026-05-01"
- name: "arXiv 2604.24020 - Endogenous Security Awareness Training for Autonomous AI Agents"
url: "https://arxiv.org/html/2604.24020v1"
date: "2026-04-27"
- name: "Cymulate - Zero-Click RCE via Prompt Injection in AI Tools (Cursor CLI, AWS Kiro, Codex)"
url: "https://cymulate.com/blog/zero-click-rce-prompt-injection-ai-tools/"
date: "2026-05-06"
- name: "Forcepoint X-Labs - 10 Indirect Prompt Injection Payloads Caught in the Wild"
url: "https://www.forcepoint.com/blog/x-labs/indirect-prompt-injection-payloads"
date: "2026-04-22"
- name: "Microsoft Security Blog - CVE-2026-26030 RCE in AI Agent Frameworks (Prompts Become Shells)"
url: "https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/"
date: "2026-05-07"
- name: "NVIDIA Developer Blog - Mitigating Indirect AGENTS.md Injection Attacks"
url: "https://developer.nvidia.com/blog/mitigating-indirect-agents-md-injection-attacks-in-agentic-environments/"
date: "2026-04-20"
- name: "OX Security - MCP STDIO Command Injection Full CVE Advisory (CVE-2026-22252, CVE-2026-22688, CVE-2025-54994)"
url: "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/"
date: "2026-04-15"
- name: "SentinelOne - CVE-2025-53107 Git MCP Server Command Injection"
url: "https://www.sentinelone.com/vulnerability-database/cve-2025-53107/"
date: "2026-04-29"
- name: "NVD - CVE-2025-66335 Apache Doris MCP Server SQL Injection"
url: "https://nvd.nist.gov/vuln/detail/CVE-2025-66335"
date: "2026-04-20"
- name: "Stormshield - OpenClaw and Claude in 2026: Risks and Retrospectives"
url: "https://www.stormshield.com/news/openclaw-claude-risks-and-retrospectives/"
date: "2026-05-07"
- name: "TruFoundry - MCP Tool Poisoning: Attack on the Channel the Model Trusts Most"
url: "https://www.truefoundry.com/blog/blog-mcp-tool-poisoning-gateway-defense"
date: "2026-05-05"
- name: "Tenable / NVD - CVE-2026-42559 RMCP Rust SDK DNS Rebinding"
url: "https://www.tenable.com/cve/CVE-2026-42559"
date: "2026-05-14"
- name: "Tenable - CVE-2026-35568 MCP Java SDK DNS Rebinding"
url: "https://www.tenable.com/cve/CVE-2026-35568"
date: "2026-04-07"
- name: "SentinelOne - CVE-2026-39313 mcp-framework HTTP DoS"
url: "https://www.sentinelone.com/vulnerability-database/cve-2026-39313/"
date: "2026-04-16"
- name: "VentureBeat - Six Exploits Broke AI Coding Agents, IAM Never Saw Them"
url: "https://venturebeat.com/security/six-exploits-broke-ai-coding-agents-iam-never-saw-them"
date: "2026-04-30"
- name: "Adversa AI - TrustFall: AI Coding Agent Supply Chain Attack via Folder Trust Dialog"
url: "https://adversa.ai/blog/trustfall-supply-chain-attack-ai-coding-agents/"
date: "2026-05-08"
- name: "AWS + Cisco - Securing AI Agents: How AWS and Cisco AI Defense Scale MCP and A2A"
url: "https://aws.amazon.com/blogs/machine-learning/securing-ai-agents-how-aws-and-cisco-ai-defense-scale-mcp-and-a2a-deployments/"
date: "2026-05-13"
# ═══════════════════════════════════════════════════════════════
# MALICIOUS AUTHORS (confirmed by security researchers)
# ═══════════════════════════════════════════════════════════════
malicious_authors:
# Snyk ToxicSkills confirmed — block ALL skills from these authors
- name: "zaycv"
source: "Snyk ToxicSkills"
risk: "critical"
notes: "40+ malicious skills, programmatic malware campaign, clawhub/clawdhub1 typosquats"
- name: "Aslaep123"
source: "Snyk ToxicSkills"
risk: "critical"
notes: "Malicious crypto/trading skills, typosquatted exchange tools"
- name: "pepe276"
source: "Snyk ToxicSkills"
risk: "critical"
notes: "Unicode-obfuscated instructions, DAN-style jailbreaking for exfiltration"
- name: "moonshine-100rze"
source: "Snyk ToxicSkills"
risk: "critical"
notes: "Mixed prompt-injection + exfil; GitHub repo aztr0nutzs/NET_NiNjA.v1.2 hosts additional weaponized skills"
# VirusTotal confirmed — single publisher, 354+ skills, 100% malicious
- name: "hightower6eu"
source: "VirusTotal OpenClaw Analysis / Particula.tech"
risk: "critical"
notes: "354 malicious skills (updated March 2026; previously 314+); all confirmed malicious by VirusTotal scan; malware disguised as productivity/utility tools"
# Bitdefender / Particula confirmed — automated bulk submission
- name: "sakaen736jih"
source: "Particula.tech / Bitdefender (2026-03)"
risk: "critical"
notes: "199 malicious skills submitted via automation (one skill every few minutes); contributed to ClawHavoc campaign expansion from 341 to 1,184+ confirmed malicious entries by March 1, 2026"
# ═══════════════════════════════════════════════════════════════
# MALICIOUS SKILLS (confirmed by researchers)
# Organized by campaign and type for efficient scanning
# ═══════════════════════════════════════════════════════════════
malicious_skills:
# ─── Snyk ToxicSkills confirmed ───
- name: "clawhud"
type: "typosquatting"
target: "clawhub"
source: "Snyk ToxicSkills"
risk: "critical"
- name: "clawhub1"
type: "typosquatting"
target: "clawhub"
source: "Snyk ToxicSkills"
risk: "critical"
- name: "clawdhub1"
type: "typosquatting"
target: "clawhub"
source: "Snyk ToxicSkills"
risk: "critical"
- name: "polymarket-traiding-bot"
type: "malware"
source: "Snyk ToxicSkills + Koi AuthTool"
risk: "critical"
notes: "Typosquatting + credential theft"
# ─── ClawHavoc campaign: ClawHub CLI typosquats (29 skills) ───
# All deploy Atomic Stealer (AMOS) via fake prerequisites
- name: "clawhub"
type: "typosquatting"
target: "clawhub-cli"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhubb"
type: "typosquatting"
target: "clawhub-cli"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhubcli"
type: "typosquatting"
target: "clawhub-cli"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawwhub"
type: "typosquatting"
target: "clawhub-cli"
source: "Koi ClawHavoc"
risk: "critical"
- name: "cllawhub"
type: "typosquatting"
target: "clawhub-cli"
source: "Koi ClawHavoc"
risk: "critical"
# 23 random-suffix variants — match with pattern "clawhub-*"
- name: "clawhub-6yr3b"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-c9y4p"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-d4kxr"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-f3qcn"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-gpcrq"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-gstca"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-hh1fd"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-hh2km"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-hylhq"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-i7oci"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-i9zhz"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-ja7eh"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-krmvq"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-oihpl"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-olgys"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-osasg"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-rkvny"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-sxtsn"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-tlxx5"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-uoeym"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-wixce"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
- name: "clawhub-wotp2"
type: "typosquatting"
source: "Koi ClawHavoc"
risk: "critical"
# ─── ClawHavoc: Crypto tools (111 skills) ───
# Solana wallet (33 variants) — pattern: solana-*
- name: "solana-*"
type: "malware"
category: "crypto"
source: "Koi ClawHavoc"
risk: "critical"
notes: "33 variants (solana-07bcb through solana-ytzgw), deploys AMOS"
# Phantom wallet (29 variants) — pattern: phantom-*
- name: "phantom-*"
type: "malware"
category: "crypto"
source: "Koi ClawHavoc"
risk: "critical"
notes: "29 variants (phantom-0jcvy through phantom-ygmjc), deploys AMOS"
# Wallet trackers (25 variants) — pattern: wallet-tracker-*
- name: "wallet-tracker-*"
type: "malware"
category: "crypto"
source: "Koi ClawHavoc"
risk: "critical"
notes: "25 variants (wallet-tracker-0ghsk through wallet-tracker-zih4w)"
# Insider wallet finders (23 variants) — pattern: insider-wallets-finder-*
- name: "insider-wallets-finder-*"
type: "malware"
category: "crypto"
source: "Koi ClawHavoc"
risk: "critical"
notes: "23 variants (insider-wallets-finder-1a7pi through insider-wallets-finder-zzs2p)"
# Ethereum gas trackers (14 variants) — pattern: ethereum-gas-tracker-*
- name: "ethereum-gas-tracker-*"
type: "malware"
category: "crypto"
source: "Koi ClawHavoc"
risk: "critical"
notes: "14 variants"
# Lost Bitcoin (3 skills)
- name: "lost-bitcoin-10li1"
type: "malware"
category: "crypto"
source: "Koi ClawHavoc"
risk: "critical"
- name: "lost-bitcoin-dbrgt"
type: "malware"
category: "crypto"
source: "Koi ClawHavoc"
risk: "critical"
- name: "lost-bitcoin-eabml"
type: "malware"
category: "crypto"
source: "Koi ClawHavoc"
risk: "critical"
# ─── ClawHavoc: YouTube utilities (57 skills) ───
# Summarizers (29 variants) — pattern: youtube-summarize-*
- name: "youtube-summarize-*"
type: "malware"
category: "youtube"
source: "Koi ClawHavoc"
risk: "critical"
notes: "29 variants, deploys AMOS"
# Thumbnail grabbers (13 variants) — pattern: youtube-thumbnail-grabber-*
- name: "youtube-thumbnail-grabber-*"
type: "malware"
category: "youtube"
source: "Koi ClawHavoc"
risk: "critical"
notes: "13 variants"
# Downloaders (13 variants) — pattern: youtube-video-downloader-*
- name: "youtube-video-downloader-*"
type: "malware"
category: "youtube"
source: "Koi ClawHavoc"
risk: "critical"
notes: "13 variants"
# ─── ClawHavoc: Polymarket bots (34 skills) ───
- name: "poly"
type: "malware"
category: "polymarket"
source: "Koi ClawHavoc"
risk: "critical"
- name: "polym"
type: "malware"
category: "polymarket"
source: "Koi ClawHavoc"
risk: "critical"
- name: "polymarkets"
type: "malware"
category: "polymarket"
source: "Koi ClawHavoc"
risk: "critical"
- name: "polytrading"
type: "malware"
category: "polymarket"
source: "Koi ClawHavoc"
risk: "critical"
# 30 random-suffix variants — pattern: polymarket-*
- name: "polymarket-*"
type: "malware"
category: "polymarket"
source: "Koi ClawHavoc"
risk: "critical"
notes: "30 variants (polymarket-25nwy through polymarket-z7lwp)"
# ─── ClawHavoc: Auto-updaters (30 skills) ───
- name: "amir"
type: "malware"
category: "updater"
source: "Koi ClawHavoc"
risk: "critical"
- name: "update"
type: "malware"
category: "updater"
source: "Koi ClawHavoc"
risk: "critical"
- name: "updater"
type: "malware"
category: "updater"
source: "Koi ClawHavoc"
risk: "critical"
- name: "auto-updater-*"
type: "malware"
category: "updater"
source: "Koi ClawHavoc"
risk: "critical"
notes: "27 variants (auto-updater-161ks through auto-updater-xsunp)"
# ─── ClawHavoc: Finance & social (76 skills) ───
- name: "yahoo-finance-*"
type: "malware"
category: "finance"
source: "Koi ClawHavoc"
risk: "critical"
notes: "24 variants"
- name: "x-trends-*"
type: "malware"
category: "social"
source: "Koi ClawHavoc"
risk: "critical"
notes: "25 variants"
# ─── ClawHavoc: Google Workspace (17 skills) ───
- name: "google-workspace-*"
type: "malware"
category: "productivity"
source: "Koi ClawHavoc"
risk: "critical"
notes: "17 variants targeting Gmail/Calendar/Drive"
# ─── Koi outliers: AuthTool campaign (3 skills) ───
# NOT AMOS — separate payload
- name: "base-agent"
type: "malware"
source: "Koi ClawHavoc (AuthTool)"
risk: "critical"
notes: "Fake auth tool dropping separate payload"
- name: "bybit-agent"
type: "malware"
source: "Koi ClawHavoc (AuthTool)"
risk: "critical"
notes: "Fake auth tool dropping separate payload"
# ─── Koi outliers: Hidden backdoor (2 skills) ───
# Inline reverse shell to 54.91.154.110:13338
- name: "better-polymarket"
type: "backdoor"
source: "Koi ClawHavoc"
risk: "critical"
notes: "Reverse shell to 54.91.154.110:13338 via /bin/bash -i >/dev/tcp/..."
- name: "polymarket-all-in-one"
type: "backdoor"
source: "Koi ClawHavoc"
risk: "critical"
notes: "Reverse shell to 54.91.154.110:13338"
# ─── Koi outliers: Credential exfiltration (1 skill) ───
- name: "rankaj"
type: "credential-theft"
source: "Koi ClawHavoc"
risk: "critical"
notes: "Reads ~/.clawdbot/.env, POSTs to webhook.site/358866c4-81c6-4c30-9c8c-358db4d04412"
# ─── Supply chain: Malicious MCP servers on PyPI (JFrog) ───
- name: "mcp-runcmd-server"
type: "supply-chain"
platform: "pypi"
source: "JFrog"
risk: "critical"
notes: "Reverse shell to 45.115.38.27:4433 before starting MCP server"
- name: "mcp-runcommand-server"
type: "supply-chain"
platform: "pypi"
source: "JFrog"
risk: "critical"
notes: "Reverse shell to 45.115.38.27:4433"
- name: "mcp-runcommand-server2"
type: "supply-chain"
platform: "pypi"
source: "JFrog"
risk: "critical"
notes: "Reverse shell to 45.115.38.27:4433"
# ─── Supply chain: Malicious npm MCP package ───
- name: "postmark-mcp"
type: "supply-chain"
platform: "npm"
source: "Defender's Initiative"
risk: "critical"
notes: "Squatter copying official Postmark MCP with hidden backdoor"
# ─── GhostClaw: Malicious npm package (March 2026) ───
- name: "@openclaw-ai/openclawai"
type: "supply-chain"
platform: "npm"
source: "The Hacker News (GhostClaw)"
risk: "critical"
notes: "GhostLoader RAT — persistent daemon, SOCKS5 proxy, live browser session cloning, clipboard monitor (every 3s for private keys/API keys), steals credentials/SSH keys/Apple Keychain/iMessage; 178 downloads before discovery; uploaded 2026-03-03"
# ─── ambar-src: Malicious npm developer tool (~50K downloads) ───
- name: "ambar-src"
type: "supply-chain"
platform: "npm"
source: "Security research (2026-03)"
risk: "critical"
notes: "~50,000 downloads; uses evasion techniques to avoid detection; targets developer machines with malware delivery"
# ═══════════════════════════════════════════════════════════════
# MALICIOUS SKILL PATTERNS (for wildcard/regex matching)
# Use these when scanning installed skills by name
# ═══════════════════════════════════════════════════════════════
malicious_skill_patterns:
# Exact prefix matches — any skill starting with these is suspicious
- pattern: "clawhub-"
campaign: "ClawHavoc"
risk: "critical"
notes: "29 typosquat variants with random suffixes"
- pattern: "solana-"
campaign: "ClawHavoc"
risk: "critical"
notes: "33 crypto wallet variants"
- pattern: "phantom-"
campaign: "ClawHavoc"
risk: "critical"
notes: "29 phantom wallet variants"
- pattern: "wallet-tracker-"
campaign: "ClawHavoc"
risk: "critical"
notes: "25 wallet tracker variants"
- pattern: "insider-wallets-finder-"
campaign: "ClawHavoc"
risk: "critical"
notes: "23 variants"
- pattern: "ethereum-gas-tracker-"
campaign: "ClawHavoc"
risk: "critical"
notes: "14 variants"
- pattern: "youtube-summarize-"
campaign: "ClawHavoc"
risk: "critical"
notes: "29 summarizer variants"
- pattern: "youtube-thumbnail-grabber-"
campaign: "ClawHavoc"
risk: "critical"
notes: "13 variants"
- pattern: "youtube-video-downloader-"
campaign: "ClawHavoc"
risk: "critical"
notes: "13 variants"
- pattern: "polymarket-"
campaign: "ClawHavoc"
risk: "critical"
notes: "30 random-suffix variants"
- pattern: "auto-updater-"
campaign: "ClawHavoc"
risk: "critical"
notes: "27 variants"
- pattern: "yahoo-finance-"
campaign: "ClawHavoc"
risk: "critical"
notes: "24 variants"
- pattern: "x-trends-"
campaign: "ClawHavoc"
risk: "critical"
notes: "25 variants"
- pattern: "google-workspace-"
campaign: "ClawHavoc"
risk: "critical"
notes: "17 variants"
- pattern: "lost-bitcoin-"
campaign: "ClawHavoc"
risk: "critical"
notes: "3 variants"
- pattern: "mcp-runcmd"
campaign: "PyPI supply chain"
risk: "critical"
notes: "JFrog: reverse shell MCP servers"
- pattern: "mcp-runcommand"
campaign: "PyPI supply chain"
risk: "critical"
notes: "JFrog: reverse shell MCP servers"
# ═══════════════════════════════════════════════════════════════
# CVE DATABASE (MCP servers & AI agent tools)
# ═══════════════════════════════════════════════════════════════
cve_database:
# --- Anthropic Filesystem MCP ---
- id: "CVE-2025-53109"
component: "Filesystem MCP Server"
severity: "high"
description: "Symlink escape to arbitrary filesystem access / potential LPE"
source: "Cymulate EscapeRoute"
fixed_in: "0.6.3 / 2025.7.1"
mitigation: "Update to >= 0.6.3; avoid Filesystem MCP in sensitive environments"
- id: "CVE-2025-53110"
component: "Filesystem MCP Server"
severity: "high"
description: "Naive prefix-match directory bypass (startsWith on paths)"
source: "Cymulate EscapeRoute"
fixed_in: "0.6.3 / 2025.7.1"
mitigation: "Update to >= 0.6.3"
# --- Anthropic MCP Inspector ---
- id: "CVE-2025-49596"
component: "MCP Inspector"
severity: "critical"
cvss: 9.4
description: "RCE via unauthenticated proxy on 0.0.0.0; drive-by RCE from malicious web page"
source: "Recorded Future / SocRadar"
fixed_in: "0.14.1"
mitigation: "Update to >= 0.14.1; restrict to localhost"
notes: "~560 exposed instances found on Shodan"
# --- Anthropic MCP Git Server (3 flaws, Jan 2026) ---
- id: "CVE-2025-68143"
component: "MCP Git Server (mcp-server-git)"
severity: "high"
description: "git_init path traversal — arbitrary filesystem path for repo creation"
source: "The Hacker News / PointGuard AI"
fixed_in: "2025.9.25"
mitigation: "Update; restrict Git MCP to trusted repos"
- id: "CVE-2025-68144"
component: "MCP Git Server (mcp-server-git)"
severity: "high"
description: "Argument injection in git_diff/git_checkout — shell metacharacters via user-controlled args"
source: "The Hacker News / PointGuard AI"
fixed_in: "2025.12.18"
mitigation: "Update; sanitize all user inputs to git CLI"
- id: "CVE-2025-68145"
component: "MCP Git Server (mcp-server-git)"
severity: "high"
description: "--repository path validation bypass — access beyond allowlist"
source: "The Hacker News / PointGuard AI"
fixed_in: "2025.12.18"
mitigation: "Update; enforce strict path validation"
# --- MCP Python SDK ---
- id: "CVE-2025-66416"
component: "MCP Python SDK (mcp on PyPI)"
severity: "medium"
description: "DNS rebinding to local HTTP MCP servers when using FastMCP HTTP/SSE with no auth"
source: "Debian Security Tracker"
fixed_in: "1.23.0"
mitigation: "Update to >= 1.23.0; enable TransportSecuritySettings explicitly"
# --- MCP Gateway ---
- id: "CVE-2025-64443"
component: "MCP Gateway"
severity: "medium"
description: "DNS rebinding against SSE/streaming listeners — indirect access to MCP servers behind gateway"
source: "Blog Gowrishankar"
fixed_in: "0.28.0"
mitigation: "Update to > 0.27.0"
# --- MCP TypeScript SDK ---
- id: "CVE-2026-25536"
component: "MCP TypeScript SDK"
severity: "high"
description: "Cross-client response data leak when reusing single server+transport across multiple SSE clients"
source: "Feedly CVE"
fixed_in: "1.26.0"
mitigation: "Update to >= 1.26.0; isolate transport instances per client"
# --- Cursor IDE ---
- id: "CVE-2025-54135"
component: "Cursor IDE"
severity: "high"
cvss: 8.6
description: "CurXecute — RCE via prompt injection writing .cursor/mcp.json"
source: "Checkpoint / PropelCode"
fixed_in: "1.3.9"
mitigation: "Update to Cursor >= 1.3.9; file integrity monitoring on mcp.json"
- id: "CVE-2025-54136"
component: "Cursor IDE"
severity: "high"
description: "MCPoison — persistent RCE via trusted config mutation; post-approval changes auto-execute"
source: "Checkpoint"