ACVE advisories
ACVE is a public registry of known-vulnerable AI agent configurations, recording the harness, model, tools, permissions, versions, and files that make an agent setup exploitable.
Quickstart
npx @pickbitsai/acve locate
npx @pickbitsai/acve lock --apply
npx @pickbitsai/acve audit10 published
15 candidate
11 harnesses covered
| ID | Severity | Status | Harness/product | Config label | Summary |
|---|---|---|---|---|---|
| ACVE-2026-0007 | HIGH · CVSS 8 | Validated | gemini-cli | gemini-cli <0.39.1 + scope=project | Gemini CLI can execute commands from repository settings |
| ACVE-2026-0004 | MODERATE · CVSS 5 | Validated | claude-code | claude-code <999.0.0 | Claude Code deny rules can be bypassed through symlinked tools |
| ACVE-2026-0003 | HIGH · CVSS 8 | Validated | claude-code | claude-code <999.0.0 + scope=project + permissionMode=bypassPermissions | Claude Code project permissions can select an unsafe permission mode |
| ACVE-2026-0002 | HIGH · CVSS 8 | Validated | claude-code | claude-code <999.0.0 | Claude Code sandbox settings can permit a sandbox escape |
| ACVE-2025-0008 | HIGH · CVSS 8 | Validated | cursor | cursor <1.3.0 + scope=project | Cursor can trust a mutable project MCP configuration |
| ACVE-2025-0007 | HIGH · CVSS 8 | Validated | codex-cli | codex-cli <=0.23.0 + project.configPresent=true | Codex CLI can auto-load project configuration |
| ACVE-2025-0004 | HIGH · CVSS 8 | Validated | claude-code | claude-code <0.2.111 + permissionMode auto|acceptEdits|bypassPermissions | Claude Code can traverse paths through untrusted context |
| ACVE-2025-0003 | HIGH · CVSS 8 | Unverified advisory — awaiting validation | @modelcontextprotocol/server-filesystem | @modelcontextprotocol/server-filesystem | MCP filesystem servers permit path traversal through symlink and calendar-version paths |
| ACVE-2025-0002 | CRITICAL · CVSS 9.5 | Validated | mcp-remote | mcp-remote >=0.0.5 <0.1.16 | mcp-remote can inject operating-system commands through an untrusted URL |
| ACVE-2025-0001 | HIGH · CVSS 8 | Validated | @modelcontextprotocol/inspector | @modelcontextprotocol/inspector | MCP Inspector can bypass local authentication and rebind localhost |
| ACVE-2024-0001 | HIGH · CVSS 8 | Validated | ollama | ollama <0.1.34 | Ollama can traverse paths and reach code execution |
| ACVE-2026-0013 | MODERATE · CVSS 5 | Unverified advisory — awaiting validation | gemini-cli | gemini-cli | Gemini CLI README injection can reach allowlisted tools |
| ACVE-2026-0012 | MODERATE · CVSS 5 | Unverified advisory — awaiting validation | claude-code | claude-code + permissionMode=auto + project hooks | Claude Code project hooks run automatically inside the repository |
| ACVE-2026-0011 | HIGH · CVSS 5 | Unverified advisory — awaiting validation | codex-cli | codex-cli + trust.level=trusted + permissionMode=bypassPermissions | Codex trusted root scope combined with never-approve execution |
| ACVE-2026-0010 | HIGH · CVSS 5 | Unverified advisory — awaiting validation | any | permissionMode auto|bypassPermissions + transport http|sse | HTTP MCP servers and permissive modes form an over-privileged combination |
| ACVE-2026-0009 | MODERATE · CVSS 5 | Unverified advisory — awaiting validation | @azure/mcp | @azure/mcp | Azure MCP Server package identity and release need grounding |
| ACVE-2026-0008 | HIGH · CVSS 5 | Unverified advisory — awaiting validation | gemini-cli | gemini-cli + permissionMode=bypassPermissions | Gemini CLI yolo mode disables the tool approval boundary |
| ACVE-2026-0006 | HIGH · CVSS 8 | Unverified advisory — awaiting validation | cursor | cursor <2.5 | Cursor can execute a repository git hook |
| ACVE-2026-0005 | HIGH · CVSS 8 | Unverified advisory — awaiting validation | cursor | cursor <999.0.0 | Cursor prompt injection can reach tools outside the intended sandbox |
| ACVE-2026-0001 | HIGH · CVSS 8 | Unverified advisory — awaiting validation | claude-code | claude-code <999.0.0 + scope=project | Claude Code project settings can expose credentials through a custom base URL |
| ACVE-2025-0011 | MODERATE · CVSS 5 | Unverified advisory — awaiting validation | claude-code | claude-code <1.0.24 | Claude Code IDE extension can bypass local authentication |
| ACVE-2025-0010 | HIGH · CVSS 8 | Unverified advisory — awaiting validation | vscode-copilot-chat | vscode-copilot-chat + chat.tools.autoApprove=true | permissionMode=bypassPermissions | VS Code Copilot Chat settings can auto-approve tools |
| ACVE-2025-0009 | HIGH · CVSS 8 | Unverified advisory — awaiting validation | cursor | cursor <1.3.0 | Cursor CurXecute can inject an MCP configuration |
| ACVE-2025-0006 | HIGH · CVSS 8 | Unverified advisory — awaiting validation | claude-code | claude-code <1.0.39 + project hooks | Claude Code project hooks can inject configuration and commands |
| ACVE-2025-0005 | HIGH · CVSS 8 | Unverified advisory — awaiting validation | claude-code | claude-code <1.0.20 + permissionMode auto|acceptEdits|bypassPermissions | Claude Code can execute commands under permissive approval modes |