Injection & unsafe execution in AI-generated code

1. AI-written code exposed a Management API that fail-open authenticated an empty token and passed user input to shell exec, enabling remote OS command injection.

   MediumCVE-2026-76761Aug 20, 2026chenhg5/cc-connectGoClaudeNew attack surfaceInjection & unsafe execution

2. AI-written webhook code treated an empty configured token as authenticated, then passed a caller-supplied command to a shell, enabling unauthenticated remote code execution.

   MediumCVE-2026-76760Aug 20, 2026chenhg5/cc-connectGoClaudeDirect introductionInjection & unsafe execution

3. AI-written code interpolated a caller-controlled username into a shell command executed via execAsync, allowing command substitution and arbitrary OS command execution as the server user.

   CVE-2026-55157Aug 14, 2026ooples/token-optimizer-mcpJavaScriptClaudeDirect introductionInjection & unsafe execution

4. The AI-assisted change that added the MCP server also added a markdown renderer for report text, and its link conversion writes the URL into an href attribute without escaping quotes, so a stored link can run script when a report is opened.

   CVE-2026-19744Aug 13, 2026ccyl13/pentestifyPythonClaudeDirect introductionInjection & unsafe execution

5. AI-written GitPython blame validation blocked only output options but missed file-reading options, allowing callers to read arbitrary files through a revision argument.

   CVE-2026-78678Aug 10, 2026gitpython-developers/gitpythonPythonChatGPT/CodexFlawed AI-written codeInjection & unsafe execution

6. AI-written code interpolated a user-supplied commit hash unquoted into a shell command passed to execSync, enabling command injection on the MCP server.

   CVE-2026-19282Aug 8, 2026andreahaku/llm_memory_mcpTypeScriptClaudeDirect introductionInjection & unsafe execution

7. An AI-written hardening change checked split short-option values but not the joined form, so attacker-controlled keyword options to GitPython's clone could still smuggle in git's upload-pack option and run a command.

   HighCVE-2026-76220Aug 7, 2026gitpython-developers/gitpythonPythonChatGPT/CodexIncomplete remediationInjection & unsafe execution

8. AI-written command risk classifier in nearai ironclaw up to 0.29.1 mishandled shell command classification, enabling remote command injection exploitable by attackers.

   LowCVE-2026-18980Aug 6, 2026nearai/ironclawRustClaudeDirect introductionInjection & unsafe execution

9. Claude-coauthored schema loading used an untrusted node type as a module path. An authenticated n8n member could traverse directories and execute code in the main process.

   CVE-2026-77068Aug 5, 2026n8n-io/n8nTypeScriptClaudeDirect introductionInjection & unsafe execution

10. The AI-coauthored sandbox hardening rewrote js-task-runner to freeze global prototypes and Buffer helpers, but its freeze loop skipped function-typed prototypes (typeof Function.prototype is function). A workflow author could still pollute Function.prototype, recover host globals, and with an allowlisted import escape the VM sandbox.

    CVE-2026-77083Aug 5, 2026n8n-io/n8nTypeScriptGitHub CopilotFlawed AI-written codeInjection & unsafe execution

11. Copilot SWE-agent changed wildcard escaping without matching native PostgreSQL SQL, so unauthenticated searches could force broad scans and degrade availability.

    CVE-2026-76212Aug 4, 2026thorsten/phpmyfaqPHPGitHub CopilotDirect introductionInjection & unsafe execution

12. The GitHub Copilot coding agent extended a pre-existing human-written flaw — interpolating unvalidated arguments into DQL — by adding unquoted timeframe interpolation to list_vulnerabilities and get_kubernetes_events, the latter already vulnerable through its clusterId sink.

    GHSA-PQH8-P93P-2RX7Jul 31, 2026dynatrace-oss/dynatrace-mcpTypeScriptGitHub CopilotFlawed AI-written codeInjection & unsafe execution

13. AI-written chat adapter treated a spoofable profile display name as an allowlisted identity, letting any contact impersonate an approved sender on the messaging gateway.

    CVE-2026-17432Jul 26, 2026nousresearch/hermes-agentPythonClaudeDirect introductionInjection & unsafe execution

14. AI-written code validated unsafe options using only kwarg keys, allowing option tokens smuggled in values to bypass the guard and execute arbitrary commands.

    HighCVE-2026-73625Jul 24, 2026gitpython-developers/gitpythonPythonChatGPT/CodexIncomplete remediationInjection & unsafe execution

15. Copilot-assisted TypeScript code rendered attacker-controlled Nunjucks templates with host objects and unrestricted JavaScript member access. The direct fix blocks prototype traversal and function calls and exposes only copied own data.

    CriticalCVE-2026-73299Jul 24, 2026microsoft/promptyRustGitHub CopilotFlawed AI-written codeInjection & unsafe execution

16. n8n read an unchecked array property across its expression sandbox boundary. The repair restricts access to valid array indices and checks returned values before crossing the boundary.

    MediumCVE-2026-72769Jul 22, 2026n8n-io/n8nTypeScriptClaudeDirect introductionInjection & unsafe execution

17. AI-written code wrote unsanitized attacker-controlled submodule names into .git/config section headers, enabling config injection and arbitrary directive execution.

    HighCVE-2026-69097Jul 20, 2026gitpython-developers/gitpythonPythonChatGPT/CodexIncomplete remediationInjection & unsafe execution

18. A Copilot-assisted TypeScript runtime loaded .prompty files through gray-matter with the library's default frontmatter engines, so a file that opened with a JavaScript frontmatter block ran its code during parsing. The repair rejects JavaScript frontmatter outright.

    CVE-2026-53597Jul 17, 2026microsoft/promptyTypeScriptGitHub CopilotFlawed AI-written codeInjection & unsafe execution

19. An AI-written fix for unsafe git options left GitPython's ls_remote accepting unsafe ext:: transport URLs, so applications passing an attacker-chosen remote could still run a helper until 3.2.0.

    HighCVE-2026-67323Jul 12, 2026gitpython-developers/gitpythonPythonChatGPT/CodexFlawed AI-written codeInjection & unsafe execution

20. AI-written code passed a Livewire container value into a shell command executed via SSH without sanitization, enabling command injection.

    CVE-2026-34599Jul 6, 2026coollabsio/coolifyPHPClaudeDirect introductionInjection & unsafe execution

21. AI-written code used eval with an empty locals dict, falsely assuming it was safe, enabling LLM-generated expressions to reach builtins and achieve RCE.

    CVE-2026-54769Jul 6, 2026langroid/langroidPythonGitHub CopilotFlawed AI-written codeInjection & unsafe execution

22. AI-written code interpolated the unescaped dev_helper_version into a shell command, enabling command injection for attackers who control that value.

    LowCVE-2026-42148Jul 6, 2026coollabsio/coolifyPHPClaudeDirect introductionInjection & unsafe execution

23. An AI-attributed change co-authored by Claude Opus 4.6 introduced the gql template tag, whose concatenation of interpolated values into the GraphQL document created the injection flaw.

    MediumGHSA-5C7W-4WM3-85VWJul 2, 2026asymmetric-effort/specifyjsTypeScriptClaudeDirect introductionInjection & unsafe execution

24. An AI-assisted SSR feature serializes application-supplied styles into HTML. Untrusted values can cross into legacy CSS-expression execution when the recipient uses a susceptible document mode.

    CVE-2026-50290Jul 2, 2026asymmetric-effort/specifyjsTypeScriptClaudeDirect introductionInjection & unsafe execution

25. Claude-authored SQL validation used an incomplete function denylist, allowing database users with sufficient privileges to read server files.

    HighCVE-2026-50180Jul 2, 2026langroid/langroidPythonClaudeIncomplete remediationInjection & unsafe execution

26. AI-written code invoked git through a shell without escaping the untrusted branch name, letting any PowerLine SpawnSession caller run arbitrary commands on provisioned hosts.

    GHSA-VV65-F55V-XM6GJul 2, 2026nick-pape/grackleTypeScriptClaudeDirect introductionInjection & unsafe execution

27. Claude-coauthored Slack approval code reused an exec-only approver check for plugin approvals, letting exec approvers bypass channel rules.

    GHSA-WV26-J37Q-2G7PJul 2, 2026openclaw/openclawTypeScriptClaudeFlawed AI-written codeInjection & unsafe execution

28. AI-written code configured unsandboxed GraalVM evaluators with HostAccess.ALL, enabling unauthenticated attackers to achieve remote OS command execution via workflow expressions.

    CriticalCVE-2026-58138Jun 30, 2026conductor-oss/conductorJavaClaudeCausal contributionInjection & unsafe execution

29. AI-added proxy_only() exposed the mode without enforcing its seccomp-notify fallback, letting sandboxed children bypass proxy rules and open direct TCP connections.

    GHSA-72W7-MF9G-733PJun 26, 2026nolabs-ai/nono-pyPythonClaudeDirect introductionInjection & unsafe execution

30. The AI-written UI backend accepted an --auth flag (printed Auth: enabled) but never read the env var or registered any auth middleware. Every client reaching the bound port, including --share, had full training control and path traversal via unsafe paths.

    CVE-2026-48797Jun 26, 2026mcp-tool-shop-org/backpropagatePythonClaudeDirect introductionInjection & unsafe execution

31. AI-written code allowed the github.credential_command setting from untrusted local mise.toml to run arbitrary shell commands via sh -c, leading to remote code execution.

    CVE-2026-55448Jun 23, 2026jdx/miseRustClaudeDirect introductionInjection & unsafe execution

32. An AI-assisted CLI serializer exported stored budget strings with CSV syntax escaping but without neutralizing spreadsheet formulas. A person able to write data used by a victim could influence exported cells if the victim chose CSV and imported it with formula evaluation enabled. This does not establish CLI execution, automatic disclosure, or universal spreadsheet behavior. The repair combines type-aware formula neutralization with carriage-return quoting. Source releases 26.4.0, 26.5.0, 26.5.1 and 26.5.2 were checked as affected, and the repaired source and published CLI 26.6.0 package were verified.

    MediumCVE-2026-46672Jun 22, 2026actualbudget/actualTypeScriptClaudeDirect introductionInjection & unsafe execution

33. Claude-coauthored tar extraction failed to exclude link-based targets before truncating files, allowing a crafted archive to overwrite arbitrary files.

    CVE-2026-55828Jun 19, 2026qbee-io/transportGoClaudeDirect introductionInjection & unsafe execution

34. Claude-assisted MCP servers inserted tool inputs such as agent names, tasks, keys, and namespaces directly into shell command strings. A caller could break out of the quoted argument and run commands on the server; the fix passes each value as a separate process argument.

    CVE-2026-58195Jun 19, 2026ruvnet/agentic-flowTypeScriptClaudeDirect introductionInjection & unsafe execution

35. Claude-generated mock-server code evaluated attacker-controlled request expressions with the full Java bridge, enabling remote code execution.

    GHSA-2C85-RFCC-G74JJun 18, 2026karatelabs/karateJavaClaudeDirect introductionInjection & unsafe execution

36. Cursor-assisted authentication code added an environment switch that skipped every credential check. On an externally reachable server configured with that switch, anyone could invoke registered agents without a token.

    CVE-2026-57132Jun 18, 2026mervinpraison/praisonaiPythonCursorFlawed AI-written codeInjection & unsafe execution

37. A change written by Claude Code added the compute bridge for the file tools and introduced the flaw by interpolating unescaped paths and content into shell commands.

    CVE-2026-57117Jun 18, 2026mervinpraison/praisonaiPythonClaudeDirect introductionInjection & unsafe execution

38. atomic-agents-stack accepted remote MCP catalogs over cleartext HTTP and passed catalog commands to its process launcher. The repair rejects remote cleartext transport by default and adds a command allowlist.

    HighGHSA-XHCR-CQFR-M3HVJun 10, 2026dep0we/atomic-agents-stackPythonClaudeDirect introductionInjection & unsafe execution

39. AI-written get_diagnostics code ran every analyzer DLL a solution referenced without allowlist or confirmation, enabling arbitrary code execution via malicious analyzer assembly.

    CVE-2026-45555May 29, 2026marcelroozekrans/roslyn-codelens-mcpC#ClaudeDirect introductionInjection & unsafe execution

40. The execute_code tool's subprocess sandbox screened submitted programs against a fixed list of dangerous attribute names, and that list omitted the attribute that exposes the live builtins module, so a short program could still run operating system commands as the server user.

    CVE-2026-47392May 29, 2026mervinpraison/praisonaiPythonClaudeIncomplete remediationInjection & unsafe execution

41. The AI-written code configured the Prometheus exporter container to bind to 0.0.0.0 without authentication, exposing operational metrics to adjacent networks.

    GHSA-7CWM-FPFH-RRCHMay 29, 2026metal3-io/ironic-standalone-operatorGoClaudeDirect introductionInjection & unsafe execution

42. An AI-attributed change co-authored by Claude Opus 4.6 (1M context) introduced the vulnerable behavior: the config loader began copying the working directory .env into os.environ with the same trust as the home configuration.

    CVE-2026-47211May 29, 2026q00/ouroborosPythonClaudeDirect introductionInjection & unsafe execution

43. AI-written sanitizer used a whitespace-anchored regex that missed inline handlers like href="#"onclick="...", enabling stored XSS in generated pages.

    CVE-2026-48527May 29, 2026haxtheweb/haxcms-nodejsJavaScriptUnidentified AI toolDirect introductionInjection & unsafe execution

44. AI-generated code inserted unescaped user-controlled convert names into the notification dropdown via innerHTML, enabling stored XSS and arbitrary script execution for authenticated users.

    MediumCVE-2026-9806May 28, 2026misp/cti-transmutePythonClaudeDirect introductionInjection & unsafe execution

45. Claude-coauthored prompt scanning matched only simple phrases, so multi-word injections in auto-loaded project files could alter the agent's system prompt.

    CVE-2026-9366May 26, 2026nousresearch/hermes-agentPythonClaudeFlawed AI-written codeInjection & unsafe execution

46. A Claude Code-generated change introduced OSC 8 hyperlink rendering that inserts the raw session directory and origin remote URL into statusline escape sequences without sanitizing control bytes.

    LowCVE-2026-47090May 18, 2026jarrodwatts/claude-hudTypeScriptCursorDirect introductionInjection & unsafe execution

47. AI-written code inserted the user-supplied regConfig into SQL without parameterization or validation, enabling SQL injection in Marten’s full-text search APIs.

    CriticalCVE-2026-45288May 14, 2026jasperfx/martenC#ClaudeNew attack surfaceInjection & unsafe execution

48. Cursor-assisted XML validation checked a string view but forwarded the raw object. Stateful coercion could bypass the patch and restore prototype-pollution RCE.

    CVE-2026-44791May 14, 2026n8n-io/n8nTypeScriptCursorFlawed AI-written codeInjection & unsafe execution

49. Claude Opus 4.7 co-authored the change that introduced the vulnerable behavior, splicing hook input into Python source in the statusline script.

    HighCVE-2026-45136May 13, 2026cnighswonger/claude-code-cache-fixJavaScriptClaudeDirect introductionInjection & unsafe execution

50. AI-written code built a shell command with unsanitized commitSha and gitDir interpolation, enabling remote code execution via crafted Forge API responses.

    CVE-2026-30635May 11, 2026automagik-dev/genieTypeScriptClaudeDirect introductionInjection & unsafe execution

Search all 80 findings in the index →