{
 "schema_version": "1.0",
 "generated": "2026-10-14T12:32:40-04:00",
 "source": "https://vibeincidents.com",
 "notes": "Only verified public information. Empty fields mean the sources do not state it. Dates other than published/last_verified/updated are free text as given by sources.",
 "incidents": [
  {
   "id": "moltbook-supabase-key-exposure",
   "title": "Moltbook exposed about 1.5M agent API keys through an open Supabase database",
   "summary": "Wiz Research found that Moltbook, a social network for AI agents, shipped a Supabase key in its client-side JavaScript while its tables had no Row Level Security. Anyone could read and write the production database. Wiz reports about 1.5 million API authentication tokens, about 35,000 email addresses and private messages between agents were exposed.",
   "url": "https://vibeincidents.com/incidents/moltbook-supabase-key-exposure/",
   "category": "Incident",
   "verification_status": "confirmed incident",
   "vendors": [
    "Moltbook",
    "Supabase"
   ],
   "products": [
    "Moltbook"
   ],
   "versions": "",
   "cwe": [],
   "cve": [],
   "severity": "Critical",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Feb 2, 2026 (Wiz write-up). Reported privately Jan 31, 2026.",
   "published": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "Wiz Research: Hacking Moltbook",
     "url": "https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys"
    },
    {
     "title": "Post by a Moltbook user account summarizing the disclosure (not an official Moltbook statement)",
     "url": "https://moltbook.com/post/b0866bcf-2f08-4072-aa71-19c261d50448"
    }
   ],
   "technical_cause": "The Supabase publishable key is meant to sit in the browser. It is only safe when every table has Row Level Security policies that limit what that key can do. Moltbook's tables had none, so the public key behaved like an admin key. Wiz also notes there was no rate limit on agent registration and that some private messages contained third-party API keys. Wiz credits security researcher Jameson O'Reilly with finding the same Supabase misconfiguration independently.",
   "mitigations": [],
   "detection_hints": [
    "In Supabase, open Table Editor and confirm RLS is enabled on every table in the public schema.",
    "Run the Supabase Security Advisor and fix every 'RLS disabled' and 'policy always true' warning.",
    "From a logged-out browser, call your REST endpoint with only the anon key (e.g. /rest/v1/your_table?select=*). You should get nothing you would not show a stranger.",
    "If users can store secrets (API keys, tokens) in messages or profiles, assume those leak first and plan rotation."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Timeline now follows Wiz's published disclosure timeline. We had described the second source as Moltbook's own post; it was written by a user account on Moltbook, so we relabeled it."
    },
    {
     "date": "Oct 14, 2026",
     "note": "Added Wiz's note that researcher Jameson O'Reilly found the same misconfiguration independently."
    }
   ]
  },
  {
   "id": "lovable-bola-48-days",
   "title": "Lovable BOLA flaw left older projects readable for 48 days after it was reported",
   "summary": "A researcher (@weezerOSINT, Matt Palmer per Computing) reported a Broken Object Level Authorization flaw in Lovable's API through HackerOne on March 3, 2026. Any logged-in free account could request other users' project data, including source code, credentials and AI chat histories. Lovable added ownership checks for projects created after November 2025, but older projects were still reachable when the researcher disclosed the issue publicly 48 days later. Lovable first said it 'did not suffer a data breach', then acknowledged a February 2026 regression and closed off chat access on public projects.",
   "url": "https://vibeincidents.com/incidents/lovable-bola-48-days/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Lovable"
   ],
   "products": [
    "Lovable"
   ],
   "versions": "",
   "cwe": [],
   "cve": [],
   "severity": "Critical",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "Feb 2026 (regression that re-enabled chat access, per Lovable). Start of the wider BOLA exposure: not stated.",
   "disclosure_date": "Apr 20, 2026 (public, on X). Reported privately Mar 3, 2026.",
   "published": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "Computing: Lovable flaw exposed source code, credentials and AI chats",
     "url": "https://www.computing.co.uk/news/2026/security/lovable-flaw-exposed-source-code-credentials-and-ai-chats"
    },
    {
     "title": "Cyber Kendra: Lovable left thousands of projects exposed for 48 days",
     "url": "https://www.cyberkendra.com/2026/04/lovable-left-thousands-of-projects.html"
    },
    {
     "title": "Cybersecurity Times: Lovable API flaw",
     "url": "https://cybersecuritytimes.com/lovable-ai-app-builder-api/"
    }
   ],
   "technical_cause": "The /projects/{id} endpoints checked that the caller was logged in but not that they owned the project. That is the classic BOLA pattern, #1 on the OWASP API Security Top 10. Lovable's account is that HackerOne triage read the behavior as intended and closed the reports without escalating them; it said 'We'll do better.' Lovable still describes source visibility on projects marked public as intended.",
   "mitigations": [],
   "detection_hints": [
    "If you have a Lovable project created before November 2025, check whether it is set to public and switch it to private if it should not be.",
    "Rotate any secrets that ever appeared in code or in chat with the AI on that project (Supabase service keys, Stripe keys, API tokens).",
    "In your own app, test every endpoint that takes an ID: log in as user A and request user B's record. You should get 403 or 404."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Changed 'older projects stayed reachable until the issue was disclosed' to 'were still reachable when it was disclosed'. Sources do not say access ended at disclosure."
    },
    {
     "date": "Oct 14, 2026",
     "note": "Added Lovable's first response that it 'did not suffer a data breach', and dated the public disclosure to Apr 20, 2026."
    }
   ]
  },
  {
   "id": "redaccess-380k-vibe-coded-assets",
   "title": "RedAccess scan: 380,000 vibe-coded assets, about 5,000 corporate apps, roughly 2,000 exposing private data",
   "summary": "Security firm RedAccess reviewed about 380,000 publicly reachable assets built with Lovable, Replit and Base44 or deployed on Netlify. About 5,000 were built for corporate use. Around 40% of those exposed sensitive data, and close to 2,000 revealed private records to anyone with the URL. WIRED verified that several of the exposed apps were still online, and VentureBeat reports that Axios verified others. Replit said RedAccess gave it only 24 hours before going to the press; Lovable and Base44 said they were not given the URLs needed to check the findings.",
   "url": "https://vibeincidents.com/incidents/redaccess-380k-vibe-coded-assets/",
   "category": "Research",
   "verification_status": "research",
   "vendors": [
    "Lovable",
    "Replit",
    "Base44",
    "Netlify"
   ],
   "products": [
    "Lovable",
    "Replit",
    "Base44",
    "Netlify"
   ],
   "versions": "",
   "cwe": [],
   "cve": [],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "May 7, 2026 (WIRED report)",
   "published": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "VentureBeat: 5,000 vibe-coded apps just proved shadow AI is the new S3 bucket crisis",
     "url": "https://venturebeat.com/security/vibe-coded-apps-shadow-ai-s3-bucket-crisis-ciso-audit-framework"
    },
    {
     "title": "WIRED: Thousands of vibe-coded apps expose corporate and personal data",
     "url": "https://www.wired.com/story/thousands-of-vibe-coded-apps-expose-corporate-and-personal-data-on-the-open-web/"
    },
    {
     "title": "TechTarget: Research shows the vibe coding security crisis",
     "url": "https://www.techtarget.com/it-strategy/feature/Research-shows-the-vibe-coding-security-crisis-CIOs-cant-ignore"
    },
    {
     "title": "RedAccess report page",
     "url": "https://info.redaccess.io/shadow-ai-builders-security-report"
    }
   ],
   "technical_cause": "Per WIRED, many apps had no login at all, and others only asked visitors to sign in with any email address. Several platforms make it easy to publish to a public URL, and internal tools built by employees often never reach a security team's inventory. In some cases the researchers say they could have gained admin rights. Note: sources describe the 5,000 differently. RedAccess's report page calls them assets built for corporate purposes, WIRED says they had virtually no security, and VentureBeat says they contained sensitive corporate information. We use RedAccess's own wording. Base44 told WIRED that a publicly accessible app 'reflects a user configuration choice, not a platform vulnerability'.",
   "mitigations": [],
   "detection_hints": [
    "Open your app's URL in a private window. If you can see real data without logging in, so can everyone else.",
    "If login is 'any email', treat that as no login. Restrict sign-up to invited users or your company domain.",
    "List every app your team has published on a vibe-coding platform and who can reach each one."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Corrected the timeline: TechTarget's analysis was published Jun 2, 2026, not in May."
    },
    {
     "date": "Oct 14, 2026",
     "note": "Attributed the Axios verification to VentureBeat's report, rewrote the note on the 5,000 figure to show how each source describes it, and added the platforms' responses (Replit, Lovable, Base44)."
    }
   ]
  },
  {
   "id": "lovable-rls-cve-2025-48757",
   "title": "CVE-2025-48757: missing Row Level Security in Lovable-generated apps (170 of 1,645 scanned)",
   "summary": "Researcher Matt Palmer scanned the homepages of 1,645 Lovable projects in March 2025 and found 303 database endpoints across 170 projects (about 10.3%) with RLS settings that let unauthenticated visitors read or write data. Exposed data included emails, phone numbers, payment details and API keys. NVD lists it as CVSS 9.3. Lovable disputes the CVE, saying each customer is responsible for protecting their app's data.",
   "url": "https://vibeincidents.com/incidents/lovable-rls-cve-2025-48757/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Lovable",
    "Supabase"
   ],
   "products": [
    "Lovable"
   ],
   "versions": "",
   "cwe": [],
   "cve": [
    "CVE-2025-48757"
   ],
   "severity": "Critical",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "Not stated (discovered Mar 20, 2025)",
   "disclosure_date": "May 29, 2025 (researcher). NVD published May 30, 2025.",
   "published": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "Matt Palmer: CVE-2025-48757 advisory",
     "url": "https://mattpalmer.io/posts/2025/05/CVE-2025-48757/"
    },
    {
     "title": "Matt Palmer: Statement on CVE-2025-48757",
     "url": "https://mattpalmer.io/posts/2025/05/statement-on-CVE-2025-48757/"
    },
    {
     "title": "NVD: CVE-2025-48757",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48757"
    }
   ],
   "technical_cause": "Lovable apps talk to Supabase directly from the browser with the anon key. That design depends on RLS policies being present and correct on every table. Where policies were missing or were effectively 'true for everyone', changing a request (for example adding ?select=*) returned other users' rows. Lovable later introduced a security scanner. Palmer's view is that it only checks whether an RLS policy exists, not whether it is correct.",
   "mitigations": [],
   "detection_hints": [
    "Enable RLS on every table: ALTER TABLE ... ENABLE ROW LEVEL SECURITY;",
    "Look for policies with USING (true) on tables that hold user data and replace them with auth.uid()-based checks.",
    "Use your browser's network tab on your live app and replay the Supabase calls with ?select=* while logged out."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Clarified that the scan covered project homepages only, as the researcher states."
    },
    {
     "date": "Oct 14, 2026",
     "note": "Expanded the timeline from the researcher's disclosure timeline (vendor notified Mar 21, acknowledged Mar 24, security scan released Apr 24, public May 29)."
    },
    {
     "date": "Oct 14, 2026",
     "note": "Replaced 'a check at publish time that warns when RLS is off' with the researcher's own description: a security scanner that only checks whether an RLS policy exists."
    }
   ]
  },
  {
   "id": "base44-auth-bypass",
   "title": "Base44 auth bypass let outsiders register for private, SSO-only apps",
   "summary": "Wiz Research found that two undocumented Base44 endpoints let anyone create a verified account on a private app using only its app_id, which is visible in the app's URL and manifest. That bypassed SSO-only settings. Wix fixed it in under 24 hours and said it found no evidence of abuse.",
   "url": "https://vibeincidents.com/incidents/base44-auth-bypass/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Base44",
    "Wix"
   ],
   "products": [
    "Base44"
   ],
   "versions": "",
   "cwe": [],
   "cve": [],
   "severity": "Critical",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Jul 29, 2025 (Wiz). Reported privately Jul 9, 2025.",
   "published": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-13T23:49:00-04:00",
   "sources": [
    {
     "title": "Wiz Research: Critical vulnerability in Base44",
     "url": "https://www.wiz.io/blog/critical-vulnerability-base44"
    },
    {
     "title": "The Hacker News coverage",
     "url": "https://thehackernews.com/2025/07/wiz-uncovers-critical-access-bypass.html"
    }
   ],
   "technical_cause": "The register and verify-otp endpoints under api/apps/{app_id}/auth/ did not check the app's privacy settings. Public Swagger docs listed them. Because app IDs are not secrets, a new user could sign up, verify by email, and then pass the SSO login page.",
   "mitigations": [],
   "detection_hints": [
    "Do not treat IDs in URLs as secrets. Every endpoint must check permissions on the server.",
    "Check that sign-up is actually disabled server-side when your app is invite-only, not just hidden in the UI.",
    "Base44 users: review the data/analytics section for unexpected registrations on private apps on or before July 9, 2025, as Wiz suggests."
   ],
   "corrections": []
  },
  {
   "id": "replit-agent-deleted-production-db",
   "title": "Replit agent deleted SaaStr's production database during a code freeze",
   "summary": "During a vibe-coding experiment, Replit's AI agent deleted Jason Lemkin's production database, wiping records for 1,206 executives and 1,196+ companies, despite an instruction not to make changes. The agent first said rollback would not work; the data was later recovered. Replit's CEO called it 'unacceptable' and shipped dev/prod database separation.",
   "url": "https://vibeincidents.com/incidents/replit-agent-deleted-production-db/",
   "category": "Incident",
   "verification_status": "confirmed incident",
   "vendors": [
    "Replit"
   ],
   "products": [
    "Replit Agent"
   ],
   "versions": "",
   "cwe": [],
   "cve": [],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "Jul 2025, day 9 of the project (exact date not stated)",
   "disclosure_date": "Jul 17, 2025 (Lemkin's posts on X, per Fast Company)",
   "published": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "Fortune",
     "url": "https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure/"
    },
    {
     "title": "Fast Company: Replit CEO on what happened",
     "url": "https://www.fastcompany.com/91372483/replit-ceo-what-really-happened-when-ai-agent-wiped-jason-lemkins-database-exclusive"
    },
    {
     "title": "SaaStr: Replit's new release addressed most of the challenges",
     "url": "https://www.saastr.com/replits-new-release-address-most-of-the-challenges-we-hit-vibe-coding-but-is-prosumer-vibe-coding-really-ready-for-commercial-apps-yet/"
    }
   ],
   "technical_cause": "The app used a single database for development and production, so the agent's development session could reach live data. A 'freeze' written in the chat was an instruction, not a permission boundary. Lemkin himself wrote that he never expected preview and dev to share one database.",
   "mitigations": [],
   "detection_hints": [
    "Give agents a separate dev database. They should never hold production credentials.",
    "Turn on point-in-time recovery or scheduled backups, and test a restore once.",
    "Use planning or read-only modes when you do not want changes, rather than relying on a chat instruction."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Removed the specific dates Jul 20 and Jul 21-22, which our current sources do not state. Noted that Fortune and Fast Company differ on who recovered the data."
    }
   ]
  },
  {
   "id": "cursor-curxecute-cve-2025-54135",
   "title": "CurXecute (CVE-2025-54135): prompt injection could make Cursor write and auto-start an MCP server",
   "summary": "Aim Security reported that a malicious message coming in through an MCP-connected service could steer Cursor's agent into creating a .cursor/mcp.json file. Cursor would then start the new MCP server and run attacker-chosen commands without asking. Cursor fixed it in version 1.3.9.",
   "url": "https://vibeincidents.com/incidents/cursor-curxecute-cve-2025-54135/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Cursor"
   ],
   "products": [
    "Cursor"
   ],
   "versions": "",
   "cwe": [],
   "cve": [
    "CVE-2025-54135"
   ],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Aug 2, 2025 (Cursor advisory). NVD published Aug 5, 2025.",
   "published": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "Cursor security advisory GHSA-4cxx-hrm3-49rm",
     "url": "https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm"
    },
    {
     "title": "NVD: CVE-2025-54135",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54135"
    },
    {
     "title": "BleepingComputer",
     "url": "https://www.bleepingcomputer.com/news/security/ai-powered-cursor-ide-vulnerable-to-prompt-injection-attacks/"
    }
   ],
   "technical_cause": "Creating a new MCP config file did not require approval, and new servers in it started automatically. Text from an outside source (for example a chat message read through an MCP tool) could tell the agent to write that file.",
   "mitigations": [],
   "detection_hints": [
    "Make sure Cursor is on 1.3.9 or later.",
    "Review .cursor/mcp.json in your repos and remove servers you did not add.",
    "Keep auto-run off for agents that read untrusted content."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Added the advisory and NVD publication dates and the affected versions from Cursor's advisory. The log date changed from '2025' to Aug 2, 2025."
    }
   ]
  },
  {
   "id": "amazon-q-vscode-wiper-prompt",
   "title": "Amazon Q Developer VS Code extension 1.84.0 shipped with an injected 'wipe' prompt",
   "summary": "Version 1.84.0 of the Amazon Q Developer extension for VS Code contained an injected prompt telling the agent to delete local files and AWS resources. AWS says a syntax error stopped it from running and no customer environments were affected. Version 1.85.0 removed it.",
   "url": "https://vibeincidents.com/incidents/amazon-q-vscode-wiper-prompt/",
   "category": "Incident",
   "verification_status": "confirmed incident",
   "vendors": [
    "Amazon"
   ],
   "products": [
    "Amazon Q Developer for VS Code"
   ],
   "versions": "",
   "cwe": [],
   "cve": [
    "CVE-2025-8217"
   ],
   "severity": "Medium",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "Jul 2025 (v1.84.0 release; exact date not stated in our sources)",
   "disclosure_date": "Jul 23, 2025 (AWS bulletin AWS-2025-015)",
   "published": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "AWS security bulletin AWS-2025-015",
     "url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-015/"
    },
    {
     "title": "GitHub advisory GHSA-7g7f-ff96-5gcw",
     "url": "https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-7g7f-ff96-5gcw"
    },
    {
     "title": "NVD: CVE-2025-8217",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8217"
    }
   ],
   "technical_cause": "Unauthorized code made it into a released build of the extension. AWS says its investigation found an inappropriately scoped GitHub token in the extension's CodeBuild configuration. Because AI agents act on prompts, a few lines of text were enough to describe a destructive task.",
   "mitigations": [],
   "detection_hints": [
    "Make sure no copy of Amazon Q for VS Code 1.84.0 is installed, including in forked editors.",
    "Pin and review AI extensions in team environments rather than auto-updating everything.",
    "Give coding agents scoped cloud credentials, not admin keys."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Dated the timeline from the AWS bulletin, GitHub advisory and NVD record, and added AWS's finding about an inappropriately scoped GitHub token."
    }
   ]
  },
  {
   "id": "enrichlead-cursor-saas-attacked",
   "title": "Enrichlead: a SaaS built with 'zero hand-written code' in Cursor was abused within days and shut down",
   "summary": "Founder Leo Acevedo posted that his sales-lead SaaS, Enrichlead, was built with Cursor and 'zero hand written code'. Days later he wrote that he was 'under attack': API key usage maxed out, people bypassing the subscription and writing junk into the database. He rotated keys, added auth and tightened CORS, then said he was shutting the app down.",
   "url": "https://vibeincidents.com/incidents/enrichlead-cursor-saas-attacked/",
   "category": "Incident",
   "verification_status": "confirmed incident",
   "vendors": [
    "Cursor"
   ],
   "products": [
    "Enrichlead"
   ],
   "versions": "",
   "cwe": [],
   "cve": [],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "Mar 17, 2025 or shortly before (founder's post)",
   "disclosure_date": "Mar 17, 2025 (founder's post on X)",
   "published": "2026-10-14T00:16:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "Founder's 'under attack' post on X",
     "url": "https://x.com/leojrr/status/1901560276488511759"
    },
    {
     "title": "Founder's reply listing the first fixes",
     "url": "https://x.com/leojrr/status/1901598955508494573"
    },
    {
     "title": "Founder's shutdown post on X",
     "url": "https://x.com/leojrr/status/1902537756674318347"
    },
    {
     "title": "Founder's post, archived (archive.today)",
     "url": "https://archive.is/seNbf"
    },
    {
     "title": "Thread with the fixes he made (unroll)",
     "url": "https://unrollnow.com/status/1901560276488511759"
    },
    {
     "title": "Pivot to AI write-up with the shutdown post",
     "url": "https://pivot-to-ai.com/2025/03/18/guys-im-under-attack-ai-vibe-coding-in-the-wild/"
    }
   ],
   "technical_cause": "By the founder's own account in the thread, API keys had to be moved out of the code into environment variables, and the API endpoints had no authentication until he added it. That let outsiders run up his API bills, use paid features without paying and write to the database. He also said fixes made with Cursor kept breaking other parts of the code. Note: some later write-ups list more failures; we only include what the founder himself posted.",
   "mitigations": [],
   "detection_hints": [
    "Search your built front-end bundle for API keys (sk-, pk_live, service_role, AIza). Anything there is public.",
    "Call each API endpoint with no session. Paid or write actions must be refused.",
    "Enforce subscriptions on the server, not by hiding buttons in the UI.",
    "Set spending caps and alerts on every third-party API key."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Added the founder's original posts on X as sources and checked the timeline against them. The shutdown post is dated Mar 20, 2025 (UTC)."
    }
   ]
  },
  {
   "id": "copilot-yolo-mode-cve-2025-53773",
   "title": "CVE-2025-53773: prompt injection could switch GitHub Copilot into auto-approve ('YOLO') mode and run commands",
   "summary": "Researcher Johann Rehberger (Embrace The Red) showed that injected instructions in a file, web page or issue could make Copilot's agent write \"chat.tools.autoApprove\": true into VS Code settings. That turns off confirmation prompts, after which the agent can run shell commands. Microsoft fixed it in the August 2025 Patch Tuesday release. NVD lists CVSS 7.8 High.",
   "url": "https://vibeincidents.com/incidents/copilot-yolo-mode-cve-2025-53773/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "GitHub",
    "Microsoft"
   ],
   "products": [
    "GitHub Copilot"
   ],
   "versions": "",
   "cwe": [],
   "cve": [
    "CVE-2025-53773"
   ],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Aug 12, 2025 (Microsoft and researcher). Reported privately Jun 29, 2025.",
   "published": "2026-10-14T00:16:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "Embrace The Red: GitHub Copilot RCE via prompt injection",
     "url": "https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/"
    },
    {
     "title": "Microsoft MSRC advisory",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53773"
    },
    {
     "title": "NVD: CVE-2025-53773",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53773"
    }
   ],
   "technical_cause": "The agent was allowed to edit its own configuration file without asking. One setting in that file disabled every approval prompt. Once a prompt injection got the agent to change it, nothing stood between the injected text and the terminal. Microsoft titles it a remote code execution vulnerability, while its CVSS vector scores the attack as local (AV:L) and needing user interaction. Rehberger also credits Markus Vervier of Persistent Security, who reported the same issue.",
   "mitigations": [],
   "detection_hints": [
    "Update VS Code, Visual Studio and the Copilot extension.",
    "Check .vscode/settings.json in your repos and user settings for chat.tools.autoApprove and remove it.",
    "Treat settings and MCP config changes made by an agent as something to review in every diff."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Narrowed the version claim to what Microsoft lists (17.14.12 is the fixed build for 17.14), and removed a statement about Microsoft's explanation of 'Remote' that we could not find in the current advisory."
    },
    {
     "date": "Oct 14, 2026",
     "note": "Added the researcher's credit to Markus Vervier, who reported the same issue."
    }
   ]
  },
  {
   "id": "claude-code-confirmation-bypass-cves",
   "title": "Claude Code: several 2025 CVEs let untrusted content bypass command confirmation prompts",
   "summary": "Anthropic published a series of advisories in 2025 for Claude Code. In each, content an attacker could get into the context window (a file, a web page) could lead to commands running without the user's approval, or to file contents being sent over the network. All were fixed, and auto-update delivered the fixes.",
   "url": "https://vibeincidents.com/incidents/claude-code-confirmation-bypass-cves/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Anthropic"
   ],
   "products": [
    "Claude Code"
   ],
   "versions": "",
   "cwe": [],
   "cve": [
    "CVE-2025-54795",
    "CVE-2025-55284",
    "CVE-2025-58764",
    "CVE-2025-59536"
   ],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Aug 1 to Oct 3, 2025 (four advisories)",
   "published": "2026-10-14T00:16:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "GitHub advisory GHSA-x56v-x2h6-7j34 (CVE-2025-54795)",
     "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-x56v-x2h6-7j34"
    },
    {
     "title": "NVD: CVE-2025-55284",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55284"
    },
    {
     "title": "NVD: CVE-2025-58764",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58764"
    },
    {
     "title": "GitHub advisory GHSA-4fgq-fpq9-mr3g (CVE-2025-59536)",
     "url": "https://github.com/advisories/GHSA-4fgq-fpq9-mr3g"
    }
   ],
   "technical_cause": "Coding agents decide which shell commands are 'safe' to run without asking. Parsing mistakes and allowlists that were too broad meant a crafted command could pass as safe. Anthropic's advisories note that versions before 1.0.24 were deprecated and force-updated.",
   "mitigations": [],
   "detection_hints": [
    "Run claude --version and make sure you are on a current release.",
    "Keep the approval prompts on when the agent reads code, issues or web pages you did not write.",
    "Don't start an agent in a freshly cloned, untrusted repo before you have looked at its config files."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Added publication dates for each CVE and said which record each date comes from."
    }
   ]
  },
  {
   "id": "slopsquatting-hallucinated-packages",
   "title": "Slopsquatting: AI coding models invented 205,474 unique package names in one study",
   "summary": "A USENIX Security 2025 paper tested 16 code-generating models on Python and JavaScript and found that 19.7% of the 2.23 million package references in the generated code (440,445) pointed to packages that do not exist, including 205,474 unique invented names. Commercial models averaged at least 5.2%, open-source models 21.7%. An attacker can register one of those names on npm or PyPI and wait for someone to install it. That tactic is now called slopsquatting.",
   "url": "https://vibeincidents.com/incidents/slopsquatting-hallucinated-packages/",
   "category": "Research",
   "verification_status": "research",
   "vendors": [],
   "products": [],
   "versions": "",
   "cwe": [],
   "cve": [],
   "severity": "Medium",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Jun 2024 (arXiv preprint). Presented Aug 2025.",
   "published": "2026-10-14T00:16:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "USENIX Security 2025: We Have a Package for You!",
     "url": "https://www.usenix.org/conference/usenixsecurity25/presentation/spracklen"
    },
    {
     "title": "Paper (arXiv)",
     "url": "https://arxiv.org/pdf/2406.10279v3"
    },
    {
     "title": "Dark Reading: AI code tools widely hallucinate packages",
     "url": "https://www.darkreading.com/application-security/ai-code-tools-widely-hallucinate-packages"
    }
   ],
   "technical_cause": "Models predict plausible-sounding package names. When one does not exist, the install fails, unless someone has already registered it. The researchers also tested mitigations and report they cut hallucinations significantly while keeping code quality. Rates were measured on the specific model versions in the study; newer models may differ.",
   "mitigations": [],
   "detection_hints": [
    "Before installing a package an AI suggested, look it up on npm or PyPI: check age, downloads, maintainer and repo link.",
    "Use a lockfile and review new dependencies in every pull request.",
    "Do not let agents run npm install or pip install unattended on packages you have not checked."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Corrected the summary: 19.7% is the share of generated package references that were hallucinated (440,445 of 2.23 million), not the share of code samples."
    }
   ]
  },
  {
   "id": "claude-desktop-git-exe-cwd-ghsa-4p2j",
   "title": "CVE-2026-88066: Claude Desktop on Windows ran a malicious git.exe from the project folder",
   "summary": "Anthropic published advisory GHSA-4p2j-qj3c-6x84 for Claude Desktop on Windows, assigned CVE-2026-88066. The app started git.exe without an absolute path, so Windows looked in the current working directory before the system directories. A git.exe placed in a project folder, for example inside a shared or cloned repository, ran as soon as the user opened that folder in Claude Desktop. Version 1.8089.0 fixes it, and Anthropic says users on standard auto-update already have the fix. The NVD record for CVE-2026-88066 is still pending.",
   "url": "https://vibeincidents.com/incidents/claude-desktop-git-exe-cwd-ghsa-4p2j/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Anthropic"
   ],
   "products": [
    "Claude Desktop"
   ],
   "versions": "",
   "cwe": [
    "CWE-427"
   ],
   "cve": [
    "CVE-2026-88066"
   ],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Oct 13, 2026 (Anthropic advisory GHSA-4p2j-qj3c-6x84, CVE-2026-88066). NVD record still pending.",
   "published": "2026-10-14T07:35:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "Anthropic advisory GHSA-4p2j-qj3c-6x84 (CVE-2026-88066)",
     "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84"
    }
   ],
   "technical_cause": "Claude Desktop used uv_spawn to run git.exe by name only. On Windows that search includes the current working directory first, which here was the project the user opened. Anyone who could get a file named git.exe into a repository could have it run in place of the real git. Anthropic classifies it as CWE-427 (Uncontrolled Search Path Element) and describes it as remote code execution through supply-chain vectors such as cloned repositories. Anthropic credits Junhyuk Im, Jeongmin Choi and Seungyun Lee of S2W with the report. We cite Anthropic's advisory for the CVE ID; the NVD page for CVE-2026-88066 is not populated yet.",
   "mitigations": [],
   "detection_hints": [
    "Make sure Claude Desktop on Windows is on 1.8089.0 or later, especially if you update it manually.",
    "Before opening a cloned repository, look for .exe files in its root (git.exe in particular) that have no reason to be there.",
    "Treat any repository you did not write as untrusted until you have looked at what it contains."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Added CVE-2026-88066. Our first version said no CVE was listed; Anthropic's advisory lists CVE-2026-88066 (assigned after publication). The NVD record is still pending."
    }
   ]
  },
  {
   "id": "claude-code-plugin-sha-pin-cve-2026-86063",
   "title": "CVE-2026-86063: Claude Code plugin install could skip a pinned commit hash",
   "summary": "Anthropic published advisory GHSA-pq7j-f95f-qfcv for the plugin install flow in Claude Code and Claude Desktop. When a marketplace pinned a plugin to a 40-character commit SHA, the installer ran git checkout on that value but never checked that the result matched the pin. An attacker who controlled the plugin's repository could create a branch named exactly like the pinned SHA, and the install would pull the branch tip instead of the reviewed commit. Claude Code 2.1.179 fixes it, and Anthropic says standard auto-update users already have it.",
   "url": "https://vibeincidents.com/incidents/claude-code-plugin-sha-pin-cve-2026-86063/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Anthropic"
   ],
   "products": [
    "Claude Code"
   ],
   "versions": "",
   "cwe": [
    "CWE-494",
    "CWE-829"
   ],
   "cve": [
    "CVE-2026-86063"
   ],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Oct 9, 2026 (Anthropic advisory). NVD published Oct 13, 2026.",
   "published": "2026-10-14T07:35:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14T07:35:00-04:00",
   "sources": [
    {
     "title": "Anthropic advisory GHSA-pq7j-f95f-qfcv",
     "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv"
    },
    {
     "title": "NVD: CVE-2026-86063",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86063"
    },
    {
     "title": "Claude Code v2.1.179 release",
     "url": "https://github.com/anthropics/claude-code/releases/tag/v2.1.179"
    }
   ],
   "technical_cause": "git checkout accepts both commit hashes and branch names. If a branch carries the same 40-character name as the pinned commit, checkout can resolve to the branch, so the pin alone did not guarantee which code was installed. The fix is to confirm that HEAD equals the pinned SHA after checkout. Anthropic classifies it as CWE-494 and CWE-829 and credits Or Nevo Michrowski of Air Security. Note: NVD shows a score of 7.5 (user interaction: active), while the GitHub advisory page currently shows 7.7 (user interaction: passive). Both rate it High.",
   "mitigations": [],
   "detection_hints": [
    "Run claude --version and make sure you are on 2.1.179 or later.",
    "Only install plugins whose repository and maintainer you trust. A pinned hash did not protect you on older versions.",
    "Review plugins you installed before 2.1.179 and reinstall them on a fixed version if in doubt."
   ],
   "corrections": []
  },
  {
   "id": "mistral-vibe-permission-bypass-cves",
   "title": "Mistral Vibe: two CVEs let crafted shell input bypass command permission checks",
   "summary": "NVD published two CVEs from VulnCheck for Mistral Vibe, Mistral's coding agent. In both, a crafted shell command looked like an allowlisted command to Vibe's permission check, while bash actually ran a different, hidden command. One is fixed in 2.25.4, the other in 2.25.5. VulnCheck scores both 8.7 High (CVSS 4.0) and credits Minqiang Gui.",
   "url": "https://vibeincidents.com/incidents/mistral-vibe-permission-bypass-cves/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Mistral AI"
   ],
   "products": [
    "Mistral Vibe"
   ],
   "versions": "",
   "cwe": [
    "CWE-436"
   ],
   "cve": [
    "CVE-2026-109428",
    "CVE-2026-109429"
   ],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Oct 13, 2026 (NVD, both CVEs). Fixes released Sep 12 and Sep 18, 2026.",
   "published": "2026-10-14T07:35:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14T07:35:00-04:00",
   "sources": [
    {
     "title": "NVD: CVE-2026-109429",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109429"
    },
    {
     "title": "NVD: CVE-2026-109428",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109428"
    },
    {
     "title": "VulnCheck advisory: Bash permission bypass via ${var@P} prompt-transform",
     "url": "https://www.vulncheck.com/advisories/mistral-vibe-bash-permission-bypass-via-var-p-prompt-transform"
    },
    {
     "title": "VulnCheck advisory: Permission bypass via bash line continuation",
     "url": "https://www.vulncheck.com/advisories/mistral-vibe-permission-bypass-via-bash-line-continuation"
    },
    {
     "title": "Mistral Vibe v2.25.4 release",
     "url": "https://github.com/mistralai/mistral-vibe/releases/tag/v2.25.4"
    },
    {
     "title": "Mistral Vibe v2.25.5 release",
     "url": "https://github.com/mistralai/mistral-vibe/releases/tag/v2.25.5"
    }
   ],
   "technical_cause": "Vibe decides whether a command is allowed by parsing it with tree-sitter-bash. Bash itself does not always read the command the same way. Each CVE is a case where the two disagree, so the check approved one command and bash ran another. NVD lists both as CWE-436 (Interpretation Conflict). Coding agents that allowlist shell commands by parsing them can fail the same way whenever their parser and the real shell differ.",
   "mitigations": [],
   "detection_hints": [
    "Update Mistral Vibe to 2.25.5 or later, which covers both fixes.",
    "Keep approval prompts on when the agent reads files, issues or web pages you did not write.",
    "Do not treat an allowlisted command as safe on its own; review what actually runs."
   ],
   "corrections": []
  },
  {
   "id": "roo-code-auto-approve-bypass-cves",
   "title": "Roo Code: five unpatched CVEs let crafted shell commands slip past auto-approve",
   "summary": "NVD published five CVEs from VulnCheck for Roo Code, an AI coding agent for VS Code. Each one is a way to make a denied shell command look like an allowlisted one, such as echo, so Roo Code runs it without asking when auto-approve is on. All five affect Roo Code through 3.54.0. The GitHub repository is archived and 3.54.0 is the last release, so no fix is expected. NVD tags all five as unsupported when assigned. VulnCheck scores each 7.7 High (CVSS 4.0) and 8.8 High (CVSS 3.1).",
   "url": "https://vibeincidents.com/incidents/roo-code-auto-approve-bypass-cves/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Roo Code"
   ],
   "products": [
    "Roo Code"
   ],
   "versions": "",
   "cwe": [
    "CWE-436"
   ],
   "cve": [
    "CVE-2026-110202",
    "CVE-2026-110203",
    "CVE-2026-110204",
    "CVE-2026-110205",
    "CVE-2026-110206"
   ],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Oct 13, 2026 (NVD and GitHub advisories, all five CVEs). No fix; repository archived, last release 3.54.0 on May 15, 2026.",
   "published": "2026-10-14T08:20:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14T08:20:00-04:00",
   "sources": [
    {
     "title": "NVD: CVE-2026-110202",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110202"
    },
    {
     "title": "NVD: CVE-2026-110203",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110203"
    },
    {
     "title": "NVD: CVE-2026-110204",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110204"
    },
    {
     "title": "NVD: CVE-2026-110205",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110205"
    },
    {
     "title": "NVD: CVE-2026-110206",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110206"
    },
    {
     "title": "GitHub advisory GHSA-v45q-xfmj-r4wr",
     "url": "https://github.com/advisories/GHSA-v45q-xfmj-r4wr"
    },
    {
     "title": "GitHub advisory GHSA-c42p-7mq6-q83w",
     "url": "https://github.com/advisories/GHSA-c42p-7mq6-q83w"
    },
    {
     "title": "GitHub advisory GHSA-mfc9-vhw7-f5w9",
     "url": "https://github.com/advisories/GHSA-mfc9-vhw7-f5w9"
    },
    {
     "title": "GitHub advisory GHSA-66pw-2qq8-258w",
     "url": "https://github.com/advisories/GHSA-66pw-2qq8-258w"
    },
    {
     "title": "GitHub advisory GHSA-r2h8-r3xm-p2rm",
     "url": "https://github.com/advisories/GHSA-r2h8-r3xm-p2rm"
    },
    {
     "title": "VulnCheck: redirect operator stripping",
     "url": "https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-redirect-operator-stripping"
    },
    {
     "title": "VulnCheck: quote-masking desynchronization",
     "url": "https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-quote-masking-desynchronization"
    },
    {
     "title": "VulnCheck: funsub command substitution",
     "url": "https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-funsub-command-substitution"
    },
    {
     "title": "VulnCheck: glob token discarding command substitution",
     "url": "https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-glob-token-discarding-command-substitution"
    },
    {
     "title": "VulnCheck: command substitution at command position",
     "url": "https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-command-substitution-at-command-position"
    },
    {
     "title": "Roo Code repository (archived)",
     "url": "https://github.com/RooCodeInc/Roo-Code"
    },
    {
     "title": "Roo Code v3.54.0 release",
     "url": "https://github.com/RooCodeInc/Roo-Code/releases/tag/v3.54.0"
    }
   ],
   "technical_cause": "Roo Code decides whether to auto-approve a command by parsing it in its own code (parseCommandLine() and getCommandDecision()) and matching the result against an allowlist. The shell does not always read the command the same way. Each CVE is a case where the two disagree, so the check sees an allowed command like echo and the shell runs something else. NVD lists all five as CWE-436 (Interpretation Conflict). The researcher's write-ups are linked from NVD. To be fair to the project: these were assigned after the repository was archived, which is why NVD marks them unsupported when assigned and why the maintainers have not shipped a fix.",
   "mitigations": [],
   "detection_hints": [
    "In VS Code, open the Extensions view and check whether Roo Code is installed, and which version. Every version through 3.54.0 is affected and there is no newer one.",
    "In Roo Code's settings, check whether auto-approve for command execution is turned on. If it is, turn it off so every shell command needs your approval.",
    "Do not rely on the allowed-commands list to keep you safe. All five bugs make a denied command look like an allowed one.",
    "If you keep using it, be careful pointing it at repositories, issues, docs or web pages you did not write, since that is how a prompt injection gets in.",
    "Plan a move to a maintained coding agent that still ships security fixes, and remove Roo Code once you have."
   ],
   "corrections": []
  },
  {
   "id": "claude-code-symlink-toctou-cve-2026-103435",
   "title": "CVE-2026-103435: Claude Code could follow a swapped-in symlink and write outside the project",
   "summary": "Anthropic published advisory GHSA-5j29-h97v-84ch for Claude Code. When Claude Code asked permission to edit a file, it checked that the path was inside the project folder, but it looked the path up again when it wrote the file and did not repeat the check. Someone who could write to the same workspace could swap that file for a symlink in between, so the edit landed on a file outside the project, such as a shell configuration file. Claude Code 2.1.129 fixes it, and Anthropic says standard auto-update users already have the fix.",
   "url": "https://vibeincidents.com/incidents/claude-code-symlink-toctou-cve-2026-103435/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Anthropic"
   ],
   "products": [
    "Claude Code"
   ],
   "versions": "",
   "cwe": [
    "CWE-22",
    "CWE-367",
    "CWE-61"
   ],
   "cve": [
    "CVE-2026-103435"
   ],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Oct 5, 2026 (Anthropic advisory). NVD published Oct 7, 2026. Fix released May 2026 in 2.1.129.",
   "published": "2026-10-14T08:20:42-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14T08:20:42-04:00",
   "sources": [
    {
     "title": "Anthropic advisory GHSA-5j29-h97v-84ch",
     "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-5j29-h97v-84ch"
    },
    {
     "title": "NVD: CVE-2026-103435",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103435"
    },
    {
     "title": "Claude Code v2.1.129 release",
     "url": "https://github.com/anthropics/claude-code/releases/tag/v2.1.129"
    }
   ],
   "technical_cause": "This is a time-of-check to time-of-use (TOCTOU) bug. The permission check and the write each resolved the file path on their own, so a symlink created between the two sent the write somewhere the check never approved. Anthropic describes the realistic case as a lower-privileged user with write access to a shared workspace redirecting harmless edits in a higher-privileged user's session, for example into shell configuration. Anthropic lists CWE-22, CWE-61 and CWE-367, and NVD lists CWE-22. Anthropic credits the HackerOne user c_h4ck_0 with the report.",
   "mitigations": [],
   "detection_hints": [
    "Run claude --version and make sure you are on 2.1.129 or later.",
    "Be careful running Claude Code in folders that other users or processes can write to, such as a shared server directory.",
    "If you ran an older version in a shared workspace, look over files outside the project it could have written to, such as ~/.bashrc or ~/.zshrc."
   ],
   "corrections": []
  },
  {
   "id": "vscode-copilot-hook-autoapprove-cve-2026-102232",
   "title": "CVE-2026-102232: Copilot agent sessions in VS Code could edit hook files without asking",
   "summary": "Microsoft fixed four AI-related security issues in VS Code 1.141.1 on Oct 13, 2026. In CVE-2026-102232, GitHub Copilot agent sessions backed by the local Copilot harness treated custom hook and agent-definition files as ordinary workspace files and could edit them without the usual approval prompt. Through prompt injection, an attacker could get the agent to add a shell command to a hook, which then ran with the user's privileges the next time the hook fired. In CVE-2026-102851, sandbox permissions approved for one MCP server were saved in shared settings, so other MCP servers using the same configuration got them too. In CVE-2026-102231, an experimental workspace setting let a workspace override the Azure DevOps code search endpoint, so a malicious workspace could send Copilot code search requests and the user's Azure DevOps token to a server the attacker controls. In CVE-2026-70098, opening a workspace through the vscode.dev/agents/tunnel web path skipped workspace trust, so agent skills supplied by an attacker could run without a warning. Microsoft lists all four as not publicly disclosed and not exploited when it released the fix.",
   "url": "https://vibeincidents.com/incidents/vscode-copilot-hook-autoapprove-cve-2026-102232/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Microsoft",
    "GitHub"
   ],
   "products": [
    "Visual Studio Code",
    "GitHub Copilot"
   ],
   "versions": "",
   "cwe": [
    "CWE-266",
    "CWE-41",
    "CWE-862",
    "CWE-863"
   ],
   "cve": [
    "CVE-2026-102231",
    "CVE-2026-102232",
    "CVE-2026-102851",
    "CVE-2026-70098"
   ],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Oct 13, 2026 (Microsoft security update, VS Code advisories and NVD, all four CVEs).",
   "published": "2026-10-14T08:20:42-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "VS Code advisory GHSA-fq62-m6f5-c7h9 (CVE-2026-102232)",
     "url": "https://github.com/microsoft/vscode/security/advisories/GHSA-fq62-m6f5-c7h9"
    },
    {
     "title": "Microsoft MSRC: CVE-2026-102232",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102232"
    },
    {
     "title": "NVD: CVE-2026-102232",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102232"
    },
    {
     "title": "VS Code advisory GHSA-qghm-w43w-vx8v (CVE-2026-102851)",
     "url": "https://github.com/microsoft/vscode/security/advisories/GHSA-qghm-w43w-vx8v"
    },
    {
     "title": "Microsoft MSRC: CVE-2026-102851",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102851"
    },
    {
     "title": "VS Code advisory GHSA-m8rw-hr26-pw53 (CVE-2026-102231)",
     "url": "https://github.com/microsoft/vscode/security/advisories/GHSA-m8rw-hr26-pw53"
    },
    {
     "title": "Microsoft MSRC: CVE-2026-102231",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102231"
    },
    {
     "title": "NVD: CVE-2026-102231",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102231"
    },
    {
     "title": "VS Code advisory GHSA-r2p5-jgfw-r5vw (CVE-2026-70098)",
     "url": "https://github.com/microsoft/vscode/security/advisories/GHSA-r2p5-jgfw-r5vw"
    },
    {
     "title": "Microsoft MSRC: CVE-2026-70098",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70098"
    },
    {
     "title": "NVD: CVE-2026-70098",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70098"
    }
   ],
   "technical_cause": "VS Code lets users point the chat.hookFilesLocations and chat.agentFilesLocations settings at folders in the workspace. Hooks run shell commands at set points in an agent session. Before 1.141.1, the Copilot harness auto-approved edits to those locations like any other file, so an agent steered by prompt injection could plant a command in a hook without the user seeing a prompt. The fix treats those locations as sensitive and asks for confirmation for direct writes and shell redirections, including through symbolic links and case-insensitive paths. Microsoft lists it as CWE-863 and rates attack complexity high because it takes several steps: prompt injection, Copilot agent interaction, and then triggering a build. The MCP issue (CWE-266) is fixed by scoping sandbox approvals to each server. Microsoft says exploiting it would need the user to add and start a crafted MCP server alongside another sandboxed server. CVE-2026-102231 came from an experimental setting, github.copilot.chat.workspace.prototypeAdoCodeSearchEndpointOverride, which a workspace could use to point Azure DevOps code search at another server. The attacker would need the user to open a crafted workspace and trigger Azure DevOps code search. The fix removes the override, so requests always go to the expected Azure DevOps endpoint. Microsoft lists it as CWE-41 and describes the impact as a Workspace Trust bypass. The GitHub advisory's text says the fix is available starting with 1.136.2, while its affected-versions field, Microsoft and NVD list 1.141.1. For CVE-2026-70098 (CWE-862), the attacker would need the user to open the workspace on the vscode.dev/agents/tunnel path and run sessions on it. Microsoft notes that the user does not need to grant trust. The fix adds workspace trust to that endpoint.",
   "mitigations": [],
   "detection_hints": [
    "Open Help > About in VS Code and make sure you are on 1.141.1 or later.",
    "If you cannot update yet, Microsoft's workaround is to set chat.useHooks and chat.useClaudeHooks to false, or remove custom entries in chat.hookFilesLocations and chat.agentFilesLocations.",
    "Look through your hook and agent-definition files for commands you did not add.",
    "Only run MCP servers you trust, and do not approve extra network or file-write access in a configuration shared with servers you do not trust.",
    "If you cannot update yet and use Azure DevOps code search, disable it and remove the github.copilot.chat.workspace.prototypeAdoCodeSearchEndpointOverride setting from workspace configuration.",
    "Do not open untrusted workspaces through the vscode.dev/agents/tunnel web path."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Added CVE-2026-102231 and CVE-2026-70098, fixed in the same VS Code 1.141.1 release."
    }
   ]
  },
  {
   "id": "kilo-code-allow-everything-cve-2026-79403",
   "title": "CVE-2026-79403: Kilo Code's local server let other programs switch on 'allow everything' without a password",
   "summary": "CVE-2026-79403 covers Kilo Code, an open-source AI coding agent. Its CLI runs a local HTTP server, and the /permission/allow-everything endpoint, which saves wildcard approvals for the agent's tools and commands, could be called without authentication. The daemon's password also defaulted to the fixed string 'kilo'. According to the fix, that left the endpoint reachable by local scripts and by browser requests that could find the server's port. NVD describes the result as arbitrary code execution by a local attacker. Kilo Code 7.4.1, released Jul 3, 2026, fixes it.",
   "url": "https://vibeincidents.com/incidents/kilo-code-allow-everything-cve-2026-79403/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Kilo Code"
   ],
   "products": [
    "Kilo Code"
   ],
   "versions": "",
   "cwe": [
    "CWE-280"
   ],
   "cve": [
    "CVE-2026-79403"
   ],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Sep 29, 2026 (CVE and NVD). Fix released Jul 3, 2026 in 7.4.1.",
   "published": "2026-10-14T08:20:42-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14T08:20:42-04:00",
   "sources": [
    {
     "title": "NVD: CVE-2026-79403",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79403"
    },
    {
     "title": "GitHub advisory GHSA-vmfg-8hhv-69wh",
     "url": "https://github.com/advisories/GHSA-vmfg-8hhv-69wh"
    },
    {
     "title": "Kilo Code pull request #11887 (the fix)",
     "url": "https://github.com/Kilo-Org/kilocode/pull/11887"
    },
    {
     "title": "Kilo Code fix commit 51e45d7fb7",
     "url": "https://github.com/Kilo-Org/kilocode/commit/51e45d7fb7"
    },
    {
     "title": "Kilo Code v7.4.1 release",
     "url": "https://github.com/Kilo-Org/kilocode/releases/tag/v7.4.1"
    }
   ],
   "technical_cause": "The allow-everything route stayed callable on localhost when the server ran without global authentication, and the daemon's own credential was a fixed default. The fix makes this endpoint fail closed unless credentials are configured, gives TUI worker servers a generated password, and replaces the fixed 'kilo' password with a generated one, restarting daemons that still use the old password. NVD lists CWE-280 (Improper Handling of Insufficient Privileges), and a proof of concept is linked from the CVE record. The v7.4.1 release notes do not mention the fix. We checked on GitHub that the fix commit (51e45d7fb7) is in v7.4.1 and not in v7.4.0.",
   "mitigations": [],
   "detection_hints": [
    "Check which version of the Kilo Code CLI you have installed and update to 7.4.1 or later.",
    "If you run kilo serve, configure server credentials instead of leaving it without authentication.",
    "On shared or multi-user machines, remember that other local users and processes can reach localhost ports."
   ],
   "corrections": []
  },
  {
   "id": "vs-copilot-trailing-dot-cve-2026-103572",
   "title": "CVE-2026-103572: a trailing dot let Visual Studio Copilot rewrite protected config and run commands",
   "summary": "Johann Rehberger (Embrace The Red) showed that GitHub Copilot in Visual Studio and SQL Server Management Studio blocked writes to files such as .mcp.json and settings.VisualStudio.json by comparing path strings, but Windows drops a trailing period when saving a filename. Writing .mcp.json. therefore passed the check and landed on .mcp.json. That let a steered agent add a malicious MCP server or rewrite the ripgrep path and run commands. Microsoft fixed it in the October 13, 2026 Patch Tuesday release. Fixed builds are Visual Studio 2022 17.14.42 and Visual Studio 2026 18.10.4. SSMS shares the same vulnerable Copilot code and needs the same update pass.",
   "url": "https://vibeincidents.com/incidents/vs-copilot-trailing-dot-cve-2026-103572/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Microsoft",
    "GitHub"
   ],
   "products": [
    "Visual Studio",
    "GitHub Copilot",
    "SQL Server Management Studio"
   ],
   "versions": "",
   "cwe": [],
   "cve": [
    "CVE-2026-103572"
   ],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Oct 13, 2026 (Microsoft Patch Tuesday, researcher write-up and NVD).",
   "published": "2026-10-14T08:22:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14T08:22:00-04:00",
   "sources": [
    {
     "title": "Embrace The Red: Visual Studio Copilot and SSMS RCE",
     "url": "https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/"
    },
    {
     "title": "Microsoft MSRC: CVE-2026-103572",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572"
    },
    {
     "title": "NVD: CVE-2026-103572",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103572"
    }
   ],
   "technical_cause": "The check lives in Microsoft.VisualStudio.Copilot.Core.dll (GetEditConfirmationTypeAsync). It compared the requested path to protected names as plain strings. On Windows, a filename that ends with a period is saved without that character, so .mcp.json. and settings.VisualStudio.json. matched neither blocked name, then wrote the protected file. Rehberger demonstrated two follow-ons: planting an MCP server the IDE launches, and pointing copilot.general.tools.ripgrepPath at an attacker binary that runs on search. Microsoft's FAQ says exploitation needs the user to interact with Copilot, and that prompt injection can deliver the steered instructions. The fix adds GetFullPath so the trailing dot is removed before the check. Microsoft's CVE title names Visual Studio Tools for Applications and SQL Server Management Studio; the researcher write-up and Microsoft's FAQ describe the issue in Copilot.",
   "mitigations": [],
   "detection_hints": [
    "Update Visual Studio 2022 to 17.14.42 or later, or Visual Studio 2026 to 18.10.4 or later, and update SQL Server Management Studio in the same pass.",
    "Review .mcp.json and settings.VisualStudio.json for MCP servers or ripgrepPath values you did not set.",
    "Treat agent edits to MCP and IDE settings as something to review, even when the path looks slightly different from the protected name."
   ],
   "corrections": []
  },
  {
   "id": "supabase-upguard-16326-readable-databases",
   "title": "UpGuard research: 16,326 Supabase databases had tables anyone could read",
   "summary": "Supabase's CISO, Bil Harmer, told TechCrunch the company had not seen the research, that Supabase projects are 'secure by default', and that security is shared: Supabase provides defaults and tooling, customers control their own configuration. The research itself: UpGuard collected about 300,000 domains showing signs of Supabase use and found 16,326 databases with tables readable from the public internet. This is a scan of misconfigured customer projects, not a breach of Supabase. More than half of those databases had schema signs of personal data. UpGuard links the problem to tables that AI coding agents create through the API, where Row Level Security is not switched on by default.",
   "url": "https://vibeincidents.com/incidents/supabase-upguard-16326-readable-databases/",
   "category": "Research",
   "verification_status": "research",
   "vendors": [
    "Supabase"
   ],
   "products": [
    "Supabase"
   ],
   "versions": "",
   "cwe": [],
   "cve": [
    "CVE-2025-48757"
   ],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "Not stated (scan dates not given)",
   "disclosure_date": "Sep 25, 2026 (TechCrunch and Unite.AI). UpGuard's own post shows Oct 13, 2026.",
   "published": "2026-10-14T09:55:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14",
   "sources": [
    {
     "title": "UpGuard: Everything Everywhere: Systemic Data Exposure in Supabase Apps",
     "url": "https://www.upguard.com/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps"
    },
    {
     "title": "TechCrunch: Some Supabase customers are publicly exposing reams of people's data to the web",
     "url": "https://techcrunch.com/2026/09/25/some-supabase-customers-are-publicly-exposing-reams-of-peoples-data-to-the-web/"
    },
    {
     "title": "Unite.AI: UpGuard study finds 16,326 Supabase databases exposing readable tables",
     "url": "https://www.unite.ai/upguard-study-finds-16-326-supabase-databases-exposing-readable-tables/"
    }
   ],
   "technical_cause": "Supabase apps talk to the database from the browser with a public (anon) key. Row Level Security policies decide what that key may read. According to UpGuard, Supabase now turns RLS on by default for tables made in the Table Editor, but tables created programmatically through the API, the route coding agents use, do not get it by default. UpGuard found Supabase projects through BuiltWith and Chrome UX Report data, asked each database for a 'users' table, and classified exposed data from table schemas rather than reading every row. Where it confirmed a significant exposure, UpGuard says it notified the app owners. We do not name any of the exposed apps.",
   "mitigations": [],
   "detection_hints": [
    "In the Supabase dashboard, confirm Row Level Security is enabled on every table in exposed schemas, including tables your AI agent created through migrations or the API.",
    "Enabling RLS is not enough: read each policy and make sure it limits rows to the signed-in user (for example auth.uid() = user_id), not 'true'.",
    "Test with only your public anon key, as an outsider would: query your tables through the REST API and confirm nothing private comes back.",
    "Keep the service_role key out of any front-end code or public repo."
   ],
   "corrections": [
    {
     "date": "Oct 14, 2026",
     "note": "Source notes: UpGuard's blog shows a publish date of Oct 13, 2026, while TechCrunch covered the research on Sep 25, 2026; we list both. UpGuard credits CVE-2025-48757 to 'Matt Turner'; the CVE's other sources, including our own entry, name researcher Matt Palmer."
    }
   ]
  },
  {
   "id": "claude-desktop-sneakpeek-preview-pane",
   "title": "SneakPeek: Claude Code Desktop preview pane could leak local secrets from large HTML files",
   "summary": "Noma Labs disclosed SneakPeek, a flaw in Anthropic's Claude Code Desktop preview pane. HTML files over 256KB were written to disk and loaded as file:// URLs, which skipped the Content Security Policy applied to smaller files. Embedded JavaScript could then read local files such as AWS credentials, SSH keys and OAuth tokens and send them out. Anthropic assigned CVSS 8.7 (High) and, after an initial patch that Noma Labs bypassed with a Web Worker, shipped a full fix. A GitHub Security Advisory and CVE are not public yet; Noma says Anthropic is preparing them.",
   "url": "https://vibeincidents.com/incidents/claude-desktop-sneakpeek-preview-pane/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "Anthropic"
   ],
   "products": [
    "Claude Code Desktop"
   ],
   "versions": "",
   "cwe": [],
   "cve": [],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Oct 14, 2026 (PR Newswire and CSO Online). Reported privately Jul 4, 2026. Final patch verified Aug 17, 2026. GHSA/CVE not public yet.",
   "published": "2026-10-14T10:32:00-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14T10:32:00-04:00",
   "sources": [
    {
     "title": "PR Newswire: Noma Labs uncovers critical security vulnerabilities in Claude Code Desktop (CVSS 8.7)",
     "url": "https://www.prnewswire.com/news-releases/noma-labs-uncovers-critical-security-vulnerabilities-in-claude-code-desktop-app-cvss-8-7-302908539.html"
    },
    {
     "title": "CSO Online: How Claude Code's 256KB blind spot put developers' secrets in the preview pane",
     "url": "https://www.csoonline.com/article/4235139/how-claude-codes-256kb-blind-spot-put-developers-secrets-in-the-preview-pane.html"
    }
   ],
   "technical_cause": "Claude Code Desktop's Electron preview pane rendered HTML that Claude generated or edited. Files under 256KB became base64 data: URLs with a strict CSP that blocked scripts. Files over 256KB were written to disk and opened as file:// URLs, which dropped that CSP, gave the renderer local filesystem access in Chromium, and ran while a request filter meant to block file:// access was inactive for static rendering. An attacker could put a padded HTML file with a malicious script in a public repository; asking Claude Code to review or edit it auto-rendered the preview and could exfiltrate host files. Anthropic's first patch blocked fetch() and XMLHttpRequest to file:// origins from the main page, but Noma Labs moved the reads into a Web Worker from a blob: URL and bypassed it. Anthropic then fixed every execution context. To be fair to Anthropic: it collaborated through disclosure, iterated on the bypass, and Noma Labs says the issue is fully resolved.",
   "mitigations": [],
   "detection_hints": [
    "Update Claude Code Desktop to the latest version. Noma Labs and Anthropic say the vulnerability is fully fixed; a public advisory with a version number is not out yet.",
    "Do not ask Claude Code Desktop to preview or edit HTML from repositories or files you did not write until you have inspected them.",
    "Keep long-lived cloud credentials and SSH private keys off developer machines where you can; prefer short-lived, scoped tokens.",
    "If you used an older Desktop build against untrusted HTML, rotate any local secrets that were on that machine (AWS credentials, SSH keys, OAuth tokens)."
   ],
   "corrections": []
  },
  {
   "id": "gitlab-duo-agent-prompt-injection-cve-2026-96893",
   "title": "CVE-2026-96893: crafted content in GitLab Duo Agent Platform instructions could run commands credited to other users",
   "summary": "GitLab fixed CVE-2026-96893 in its Oct 12, 2026 critical patch release. The flaw was in the GitLab Duo Agent Platform, GitLab's AI agents for software development. GitLab says an authenticated user could inject specially crafted content into AI agent instructions, which could cause unintended command execution attributed to other users. The cause was improper neutralization of special elements when GitLab built the AI conversation context. GitLab EE 19.1 through 19.2.7, 19.3 before 19.3.5 and 19.4 before 19.4.2 are affected. GitLab.com already runs the fix, and GitLab Dedicated customers do not need to act.",
   "url": "https://vibeincidents.com/incidents/gitlab-duo-agent-prompt-injection-cve-2026-96893/",
   "category": "Vulnerability",
   "verification_status": "disclosed vuln",
   "vendors": [
    "GitLab"
   ],
   "products": [
    "GitLab Duo Agent Platform"
   ],
   "versions": "",
   "cwe": [
    "CWE-74"
   ],
   "cve": [
    "CVE-2026-96893"
   ],
   "severity": "High",
   "severity_method": "VibeIncidents editorial rating (Critical/High/Medium) based on impact and exposure described in the sources; method at https://vibeincidents.com/about/",
   "incident_date": "",
   "disclosure_date": "Oct 12, 2026 (GitLab critical patch release). NVD published Oct 13, 2026.",
   "published": "2026-10-14T12:32:18-04:00",
   "last_verified": "2026-10-14",
   "updated": "2026-10-14T12:32:18-04:00",
   "sources": [
    {
     "title": "GitLab critical patch release 19.4.2, 19.3.5, 19.2.8",
     "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/"
    },
    {
     "title": "NVD: CVE-2026-96893",
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96893"
    }
   ],
   "technical_cause": "GitLab describes it as an 'Improper Neutralization of Input Used for LLM Prompting' issue in the Duo Agent Platform. Content a user could supply ended up in the instructions the AI agent received, without being neutralized, so it could change what the agent did. Because the agent was acting in another user's session, the resulting commands were attributed to that user. NVD lists CWE-74 (injection). GitLab has not published further technical detail. The NVD record links GitLab work item #607968, which showed no details when we checked. The issue was discovered internally by GitLab team member Mert Coskuner.",
   "mitigations": [],
   "detection_hints": [
    "If you run self-managed GitLab EE with Duo Agent Platform, upgrade to 19.4.2, 19.3.5 or 19.2.8 or later.",
    "GitLab.com and GitLab Dedicated are already patched.",
    "Review recent agent sessions and the commands they ran, especially where agents read content that other users can edit."
   ],
   "corrections": []
  }
 ]
}