Vulnerabilities in code written with Claude

1. Nodemailer's address parser appends each address part to one growing string. A Claude-co-authored change in 9.1.0 reads that string's last character before every append, which V8 can turn into a copy of the whole string, so comment-separated addresses parse in quadratic time. Mailparser feeds inbound headers here. Release 10.0.5 caches the last character.

   HighCVE-2026-90776Sep 11, 2026nodemailer/nodemailerTypeScriptClaudeDirect introductionResource abuse & availability

2. When Nodemailer's address parser cannot read an address strictly, it scans the free text. A Claude-co-authored repair in 10.0.6 replaced the slow regular expression with a scanner whose two new probes still searched the rest of the value, so long headers could stall the event loop until 10.0.9 bounded them. Found by source analysis, not timing.

   HighGHSA-V53P-9FQP-M79JSep 11, 2026nodemailer/nodemailerTypeScriptClaudeIncomplete remediationResource abuse & availability

3. Claude-assisted browser gateway used an unanchored pattern to validate Chrome extension origins, so a crafted page could open the debugging WebSocket from any domain.

   CVE-2026-55536Aug 25, 2026mervinpraison/praisonaiPythonClaudeDirect introductionAuthentication & access control

4. PraisonAI checked literal IP addresses without resolving ordinary hostnames before Spider requests. The repair checks DNS results for blocked addresses and rejects resolution failures.

   HighCVE-2026-55526Aug 25, 2026mervinpraison/praisonaiPythonClaudeDirect introductionSSRF & network boundaries

5. Hardening of the FrameNet corpus reader tightened the checks on the names that are interpolated into XML file paths, but a corpus subdirectory can hold a symlink whose name passes those checks and points outside the corpus root, so the reader returns text from a file outside the corpus.

   CVE-2026-62384Aug 22, 2026nltk/nltkPythonClaudeFlawed AI-written codePath & link handling

6. A CLI coding assistant co-authored the commit that added the transaction API, and its single-transaction endpoint fetched any record by primary key without company scoping or a permission check.

   CVE-2026-77759Aug 21, 2026roskus/prospero-flow-crmPHPClaudeDirect introductionAuthentication & access control

7. AI-written code exposed a Management API that fail-open authenticated an empty token and passed user input to shell exec, enabling remote OS command injection.

   MediumCVE-2026-76761Aug 20, 2026chenhg5/cc-connectGoClaudeNew attack surfaceInjection & unsafe execution

8. AI-written webhook code treated an empty configured token as authenticated, then passed a caller-supplied command to a shell, enabling unauthenticated remote code execution.

   MediumCVE-2026-76760Aug 20, 2026chenhg5/cc-connectGoClaudeDirect introductionInjection & unsafe execution

9. An AI-assisted webhook request/test component adds response readback to an earlier outbound-request primitive. The shipped SQL-backed test path can cross the intended destination boundary when an admitted client can configure and test webhooks.

   CriticalCVE-2026-64849Aug 17, 2026mlflow/mlflowPythonClaudeFlawed AI-written codeSSRF & network boundaries

10. The AI-written code loads the first .so file matching a broad glob pattern without verifying integrity, enabling arbitrary code execution via a malicious module.

    CriticalCVE-2026-74872Aug 17, 2026jahlives/openssl_encryptPythonClaudeDirect introductionOther or unclear

11. AI-written code interpolated a caller-controlled username into a shell command executed via execAsync, allowing command substitution and arbitrary OS command execution as the server user.

    CVE-2026-55157Aug 14, 2026ooples/token-optimizer-mcpJavaScriptClaudeDirect introductionInjection & unsafe execution

12. AI-written web server code exposed session log endpoints without authentication, letting unauthenticated users read files via path traversal.

    MediumCVE-2026-55156Aug 14, 2026ooples/token-optimizer-mcpJavaScriptClaudeDirect introductionPath & link handling

13. The AI-assisted change that added the MCP server also added a markdown renderer for report text, and its link conversion writes the URL into an href attribute without escaping quotes, so a stored link can run script when a report is opened.

    CVE-2026-19744Aug 13, 2026ccyl13/pentestifyPythonClaudeDirect introductionInjection & unsafe execution

14. An AI-assisted dictionary-redaction repair left deeply nested JSON lists behind the recursion cutoff, allowing sensitive-key values to appear unmasked in authorized Variable responses and the UI.

    MediumCVE-2026-54183Aug 12, 2026apache/airflowPythonClaudeIncomplete remediationPath & link handling

15. A CLI coding assistant co-authored the commit that added the in-process TURN relay server, and its UDP receive loop was started fire and forget with the only exception handler outside the loop.

    GHSA-PFVM-W89X-94JWAug 12, 2026sipsorcery-org/sipsorceryC#ClaudeDirect introductionOther or unclear

16. A coding assistant co-authored the commit that added follows and notifications to this Python web app, and the four new endpoints that change that state were exposed as plain GET routes, so any page could trigger them for a signed-in user.

    CVE-2026-73162Aug 11, 2026misp/cti-transmutePythonClaudeDirect introductionAuthentication & access control

17. With the optional DeepStream stack installed, request-level video settings can activate GPU decoding without startup authorization and omit the normal metadata pixel check.

    CVE-2026-78684Aug 11, 2026vllm-project/vllmPythonClaudeDirect introductionAuthentication & access control

18. A coding assistant co-authored the commit that added emoji reactions to the comment system of this Python web app, and the new reaction endpoint never checked whether the caller was allowed to see the comment it changed.

    CVE-2026-73155Aug 11, 2026misp/cti-transmutePythonClaudeDirect introductionAuthentication & access control

19. AI-generated code placed PermissionSaveController under only authentication, omitting authorization checks, letting any authenticated user grant all permissions to any role.

    HighCVE-2026-59233Aug 10, 2026roskus/prospero-flow-crmPHPClaudeIncomplete remediationAuthentication & access control

20. A coding assistant co-authored the commit that added the following list to this Python web app, and the entries it returns include the email address of every account the signed-in user follows.

    CVE-2026-72760Aug 10, 2026misp/cti-transmutePythonClaudeDirect introductionAuthentication & access control

21. AI-written code stored unvalidated caller-supplied webhook URLs and fetched them server-side, enabling SSRF against internal services.

    CVE-2026-19340Aug 9, 2026anubissbe/projecthub-mcpTypeScriptClaudeDirect introductionSSRF & network boundaries

22. The AI-written importRiveFile tool passed an unvalidated libraryId into path.join-based manifest writes, enabling arbitrary JSON file writes via path traversal.

    CVE-2026-19288Aug 8, 2026astralisone/rive-mcp-server-coreTypeScriptClaudeNew attack surfacePath & link handling

23. AI-written journey storage code joined unvalidated journeyId values into filesystem paths, letting ../ traverse out of ~/.ui-probe/journeys to read or delete arbitrary files.

    CVE-2026-19270Aug 8, 2026hulupeep/mcp-ui-probeTypeScriptClaudeDirect introductionValidation & fail-open logic

24. AI-written code interpolated a user-supplied commit hash unquoted into a shell command passed to execSync, enabling command injection on the MCP server.

    CVE-2026-19282Aug 8, 2026andreahaku/llm_memory_mcpTypeScriptClaudeDirect introductionInjection & unsafe execution

25. A Claude Opus 4.7 assisted change reverted the earlier human symlink-target check and kept only link-name validation, so the worktree boundary still followed symlinks to their targets.

    HighCVE-2026-71556Aug 7, 2026go-git/go-gitGoClaudeFlawed AI-written codePath & link handling

26. AI-written command risk classifier in nearai ironclaw up to 0.29.1 mishandled shell command classification, enabling remote command injection exploitable by attackers.

    LowCVE-2026-18980Aug 6, 2026nearai/ironclawRustClaudeDirect introductionInjection & unsafe execution

27. Claude-coauthored schema loading used an untrusted node type as a module path. An authenticated n8n member could traverse directories and execute code in the main process.

    CVE-2026-77068Aug 5, 2026n8n-io/n8nTypeScriptClaudeDirect introductionInjection & unsafe execution

28. AI-written gateway proxy stored user-supplied API base URLs without scheme or host checks and fetched them server-side, letting authenticated users reach internal services.

    CVE-2026-71211Aug 5, 2026mlflow/mlflowTypeScriptClaudeDirect introductionAuthentication & access control

29. Claude-assisted automation code sent server-side POST requests to account-supplied URLs without the existing SSRF destination check. The direct fix blocks private and reserved targets and redirect bounces before the request.

    CVE-2026-67530Jul 30, 2026arnasdon/wacrmTypeScriptClaudeDirect introductionValidation & fail-open logic

30. Human code introduced unsafe local references; a Claude-coauthored remediation still allowed traversal, so crafted schemas could read arbitrary files.

    HighCVE-2026-55389Jul 28, 2026koxudaxi/datamodel-code-generatorPythonClaudeFlawed AI-written codePath & link handling

31. AI-written code implemented a six-capability denylist omitting SYS_TIME, letting tenants add it and bypass PodSpec safety validation.

    HighCVE-2026-50570Jul 28, 2026fission/fissionGoClaudeIncomplete remediationAuthentication & access control

32. AI-written SanitizeFilePath used a lexical HasPrefix check, letting paths like /packages-extra/evil escape the intended safe directory boundary.

    LowCVE-2026-50568Jul 28, 2026fission/fissionGoClaudeNew attack surfacePath & link handling

33. AI-written chat adapter treated a spoofable profile display name as an allowlisted identity, letting any contact impersonate an approved sender on the messaging gateway.

    CVE-2026-17432Jul 26, 2026nousresearch/hermes-agentPythonClaudeDirect introductionInjection & unsafe execution

34. Claude-assisted path sanitization stopped decoding after eight passes instead of failing closed. A deeply encoded traversal path could survive the check.

    HighCVE-2026-59221Jul 24, 2026open-webui/open-webuiPythonClaudeIncomplete remediationPath & link handling

35. n8n read an unchecked array property across its expression sandbox boundary. The repair restricts access to valid array indices and checks returned values before crossing the boundary.

    MediumCVE-2026-72769Jul 22, 2026n8n-io/n8nTypeScriptClaudeDirect introductionInjection & unsafe execution

36. Claude-coauthored local-trust code omitted Host validation, so DNS rebinding could give an attacker admin context and arbitrary command execution.

    CriticalCVE-2026-77087Jul 22, 2026paperclipai/paperclipTypeScriptClaudeDirect introductionAuthentication & access control

37. AI-written code failed to guard against dangling symlinks in Remove/RemoveAll, enabling writes outside the intended scope.

    CVE-2026-55668Jul 20, 2026filebrowser/filebrowserGoClaudeFlawed AI-written codePath & link handling

38. AI-written signing code omitted replay protections like counters or timestamps, letting attackers reinstall stale signed policies and bypass current security rules.

    CVE-2026-47133Jul 20, 2026craigjbass/clearancekitSwiftClaudeDirect introductionValidation & fail-open logic

39. AI-written code in StoreUserRequest failed to validate the role field and skipped admin authorization, letting any authenticated user mass-assign the Admin role and escalate privileges.

    MediumCVE-2026-63102Jul 20, 2026rconfig/rconfigPHPClaudeNew attack surfaceValidation & fail-open logic

40. IronClaw's path guard treated a dangling final symbolic link as a missing path inside the sandbox. The repair explicitly rejects that link before allowing a file operation.

    LowCVE-2026-16130Jul 18, 2026nearai/ironclawRustClaudeFlawed AI-written codePath & link handling

41. A Claude-assisted change added order API handlers that fetched records by ID without checking the caller's company, so users of one company could read or change another company's orders.

    CVE-2026-59237Jul 16, 2026roskus/prospero-flow-crmPHPClaudeDirect introductionAuthentication & access control

42. The native DI OAuth token writer stored credentials with umask-dependent permissions. Version 0.3.5 repairs successful owner-controlled writes; untouched older stores still require rewriting or manual restriction.

    HighCVE-2026-54447Jul 15, 2026cyberjunky/python-garminconnectPythonClaudeDirect introductionAuthentication & access control

43. A change generated with Claude Code introduced the workflow version backup tool and its storage without tenant scoping, leaving default-scope backups reachable by any authenticated tenant in multi-tenant mode.

    MediumCVE-2026-55608Jul 14, 2026czlonkowski/n8n-mcpTypeScriptClaudeDirect introductionAuthentication & access control

44. AI-written multi-tenant workflow version endpoints used workflowId/versionId without instance scope checks, letting attackers access or delete other tenants' workflow versions and node credentials.

    CVE-2026-54052Jul 14, 2026czlonkowski/n8n-mcpTypeScriptClaudeDirect introductionAuthentication & access control

45. AI-written code concatenated an unsanitized job_id into GitLab API paths, enabling path traversal that lets attackers access arbitrary endpoints with the user's token.

    CriticalCVE-2026-61462Jul 13, 2026zereight/gitlab-mcpTypeScriptClaudeNew attack surfacePath & link handling

46. openssl_encrypt printed derived hardware pepper values during its HSM test commands. The repair removes those values from command output while retaining the success and length messages.

    HighCVE-2026-74870Jul 12, 2026jahlives/openssl_encryptPythonClaudeDirect introductionOther or unclear

47. Claude-coauthored code put an unvalidated region into an upstream hostname, letting an authenticated caller send a Kiro API key to an attacker-controlled server.

    MediumCVE-2026-56678Jul 10, 2026decolua/9routerJavaScriptClaudeDirect introductionSSRF & network boundaries

48. The AI-written code installed a custom ReadFromURIFunc in loadFromGitRevision that bypassed kin-openapi's external-ref policy, allowing SSRF and local file reads when --allow-external-refs=false.

    CVE-2026-53508Jul 7, 2026oasdiff/oasdiffGoClaudeDirect introductionSSRF & network boundaries

49. Code co-written with Claude Opus 4.6 (1M context) introduced the flaw by first adding the settings routes that ha-mcp exposes without authentication at the bare root for Home Assistant ingress.

    MediumGHSA-Q855-8RH5-JFGQJul 7, 2026homeassistant-ai/ha-mcpPythonClaudeDirect introductionAuthentication & access control

50. Claude-generated validation endpoints accepted read-only API tokens but performed write-scoped provider actions, letting those tokens trigger changes.

    CVE-2026-32718Jul 6, 2026coollabsio/coolifyPHPClaudeNew attack surfaceValidation & fail-open logic

Search all 223 findings in the index →