Published CVEs in popular AI frameworks, agent tools and MCP packages

1,199 CVEs were published from January 2023 to 12 November 2026 in 22 widely used AI products. 63.5% are rated High or Critical, and in at least 59 the model’s own output reaches code execution, a file path, a query or a URL fetch.

Figure 1. CVEs published in the 22 products between 1 January and 12 November of each year, so every year covers the same window. The 2026 count is 4.8 times 2025. Part of the 2026 rise is more reporting: GitHub’s CNA filed 428 of the 862 CVEs published in 2026, IBM 185 (Langflow) and VulnCheck 153. The bars sum to 1,160; the other 39 of 1,199 CVEs were published from 13 November to 31 December of 2023–2025, outside the window.

Chart: PNG · SVG

Attack classes and the control that contains them

Table 1. One attack class per CVE from a codebook frozen before labelling, and the cheapest KH Labs control that contains the class while a patch is pending (patching is always the fix). By control: pre-launch red-team testing 642, an injection-safe tool gate with least-privilege tools 346, monitoring and a kill switch 153, spend caps and key hygiene 58. The sink counts in the text and this table differ by one CVE: CVE-2025-54130 (Cursor) is classed here as code execution (37 CVEs; 36 have an eval, exec or shell sink), but its sink is recorded as a file path, so the sink count puts it with the other sinks (23; 22 in the class “Model output to SQL, file path, URL or HTML”).

MCP in context

The MCP group in this study covers the official SDKs and named popular servers: 79 CVEs. A wider NVD sweep found 563 CVEs that mention MCP; the first was published on 1 May 2025 and 494 were published in 2026. That sweep covers third-party MCP servers of any popularity and is reported as context, not in the 1,199.

Cases

1. LangChain LLMMathChain (CVE-2023-29374, CVSS 9.8)

The math chain passed model output to Python’s exec. NVD: the flaw “allows prompt injection attacks that can execute arbitrary code via the Python exec method”.

Containing control: a tool gate plus a sandbox.

Sources: NVD · GitHub advisory

2. LlamaIndex Text-to-SQL (CVE-2024-23751, CVSS 9.8)

User prose was turned into SQL and run. NVD’s example: an attacker could delete records via “Drop the Students table”.

Containing control: read-only, least-privilege database credentials behind a tool gate.

Sources: NVD

3. Cursor writes its own MCP configuration (CVE-2025-54135, CVSS 9.8, fixed in 1.3.9)

Creating a new .cursor/mcp.json needed no approval, so indirect prompt injection could “trigger RCE on the victim without user approval”.

Containing control: an approval gate on writes to configuration and executable paths.

Sources: NVD

4. Langflow Agentic Assistant (CVE-2026-33873, CVSS 9.9)

The assistant “executes LLM-generated Python code during its validation phase”. Fixed in 1.9.0, released 14 April 2026, 18 days after the CVE was published.

Containing control: sandboxed execution and a tool gate.

Sources: NVD · GitHub advisory

5. Flowise Custom MCP (CVE-2025-8943, CVSS 9.8)

Before 3.0.1 the default install ran without authentication, and the Custom MCPs feature runs OS commands, so unauthenticated users could run commands. The fix was released on 29 May 2025, 77 days before the CVE was published.

Containing control: pre-launch red-team testing of default deployments.

Sources: NVD · GitHub advisory

6. MCP developer tooling (CVE-2025-49596, CVSS 9.4; CVE-2025-6514, CVSS 9.6)

MCP Inspector before 0.14.1 had no authentication between client and proxy, “allowing unauthenticated requests to launch MCP commands over stdio”. mcp-remote was “exposed to OS command injection when connecting to untrusted MCP servers” (fixed in 0.1.16).

Containing control: an MCP gateway with a server allow-list and authenticated local transports.

Sources: NVD: CVE-2025-49596 · NVD: CVE-2025-6514

What this means for a buyer

• Update promptly. In 93.6% of the CVEs with a dated fix, the fixed version was already out when the CVE was published, so teams that update on release were usually covered before the advisory.
• Treat self-hosted AI tooling like any internet-facing server. Low-code builders and the self-hosted stack account for 835 of the 1,199 CVEs, and the largest class is broken authentication or authorization (284): keep authentication on and keep these servers off untrusted networks.
• Treat model output as untrusted input. In at least 59 CVEs, model output reached code execution, a file path, a query or a URL fetch. Allow-list what a tool may run and where it may send data; blocklists were bypassed repeatedly in this dataset.
• Contain while a patch is pending. Red-team the default deployment before launch, and put an injection-safe tool gate between the model and anything that executes, fetches or writes.

How we measured

Sources. The NIST NVD CVE API 2.0 (125 logged calls: keyword searches per product, CPE queries for confirmed product names, and CVE lookups for advisories the first two missed), the GitHub Advisory Database (reviewed advisories naming an in-scope package), and package registries (PyPI, npm, the Go module proxy) for the release date of each fixed version. Retrieved on 12 November 2026; no third-party code was downloaded or run.

Scope. 22 products: LangChain (Python and JS), LlamaIndex, Haystack, AutoGPT, CrewAI, Semantic Kernel, Flowise, Langflow, Dify, Ollama, vLLM, text-generation-webui, Open WebUI, LiteLLM, the official MCP SDKs, MCP servers and tools, Gradio, Hugging Face transformers, Cursor, Cline and Continue. Inclusion criteria were written before collection: a CVE ID; an NVD publish date from 1 January 2023 to the retrieval date; not rejected; and an in-scope product shown by a GitHub-reviewed advisory (668 CVEs), an NVD CPE (408) or a reviewed NVD keyword hit (123 accepted of 197). A CVE that touches several products is counted once.

Coding. Each CVE gets one attack class from a codebook frozen before labelling; separately, the sink flag records whether the advisory text states that model output or a prompt-injection payload reaches eval, exec or a shell, SQL, a file path, an outbound URL fetch or rendered HTML. The flag is set only where the advisory says so, which is why the sink count is “at least”. Coder 1 applied the codebook’s rules; coder 2, Claude Opus 5.5 at temperature 0, labelled blind to coder 1 from the codebook, product, CWEs and description. They agreed on the attack class for 78.9% of records (κ = 0.76), and all 257 records with any disagreement were adjudicated by reading the advisory. Dates, scores, CWEs and versions come from the databases, never from the model.

Severity and dates. Severity uses NVD’s score where NVD has scored the record (453), otherwise the filing CNA’s (744) or GitHub’s (2). The fix date is the registry release date of the first fixed version; it is negative relative to the CVE date when the fix shipped first, which is normal under coordinated disclosure. Private report dates are not public, so time from report to fix is not measured.

What the numbers cover. CVE counts measure disclosure, not bug density. The 2026 rise coincides with more CNAs filing AI-tool CVEs (GitHub’s CNA filed 428 of the 862 CVEs published in 2026, IBM 185 (Langflow) and VulnCheck 153), so part of the growth is more reporting, and 2026 is compared with earlier years on the same 1 January to 12 November window. Keyword search finds products by name, so a CVE whose text never names its product and carries no CPE or advisory package would not be counted. Attack classes follow the advisory text.

Data

• cases.csv (370 KB): one row per CVE (1,199): product, publish date, CVSS score and severity, CWEs, attack class, sink flag, fixed version and its release date, both coders’ labels, control, NVD link
• sources.csv (453 KB): the NVD record (and GitHub advisory where one exists) per CVE, with the first 25 words of the NVD description
• summary.json (6 KB): every number on this page

Cite this study