Eight MITRE-assigned CVEs land at once (2026-09-30 / 10-01) for one researcher's May 2026 GitHub issues against open-source agent frameworks that execute model output or user code directly — Devika (two 9.8s), DeepTutor (9.8), DB-GPT skill upload → execution (9.8), AgentScope RealtimeAgent execute_python_code over WebSocket (9.8), agent-zero file browser rooted at / (7.5 + one unscored), Langflow /api/v1/validate/code compile+exec (unscored); most issues have no maintainer reply and none names a fixed version; thirteen more MITRE ids for the same gists followed on 10-01/02 (Devika ×3, Langchain-Chatchat ×3, SuperAGI ×4, AgentScope, Langflow) plus a VulDB 9.3 for InternLM MindSearch

TL;DR

Between 2026-09-30 and 10-01 MITRE published eight CVEs, all citing GitHub issues and gists filed by one researcher (Ro1ME) in April–May 2026, against six open-source agent frameworks that people fork, self-host and build "AI coworkers" on: Devika executes LLM-generated content in Runner.execute / Runner.run_code (CVE-2026-51871, 9.8; CVE-2026-51872); DeepTutor's TutorBot ExecTool pipes model-generated shell commands into a subprocess from a WebSocket chat (CVE-2026-51870, 9.8); DB-GPT runs a script uploaded through /api/v1/skills/upload when the react-agent chat later calls it (CVE-2026-51866, 9.8); AgentScope's RealtimeAgent lets a remote WebSocket user prompt the agent into execute_python_code with no approval or isolation step (CVE-2026-51856, 9.8); agent-zero's file browser is rooted at the host filesystem root and accepts unnormalised paths (CVE-2026-51853, 7.5; CVE-2026-51852); and Langflow's /api/v1/validate/code forwards raw Python into compile()/exec() behind authentication (CVE-2026-51886). None of the CVE records names a fixed version; four of the six issues show no maintainer reply; DB-GPT has a linked fix PR and Langflow assigned a maintainer. These are the "an agent is a remote shell with a chat UI" class — if you self-host any of them, put an OS boundary under it today and assume the model's output is attacker input.

What happened

The source shape. None of this came through a vendor advisory tab, a security blog or a CNA that validates fixes. MITRE (cve@mitre.org) assigned the ids in bulk and the only references are the reporter's GitHub issue and a gist per bug. The issues were opened 2026-04-20 (agent-zero), 05-05 (AgentScope), 05-07 (DB-GPT), 05-23 (Devika, DeepTutor) and 05-26 (Langflow) — four to five months before the CVEs. The advisory database's agent and llm recency listings showed them on 09-30 as unreviewed entries with no package metadata; the NVD keyword window for langflow surfaced the eighth on 10-01. Per this repo's rule for small projects with no advisory channel (LEARNINGS.md §10), the detailed issue is the primary and the CVE assignment is the second signal — so the status is unconfirmed, stated plainly: no vendor has confirmed, scored or fixed these in a form this sweep could read.

Per project (CVE record text, then what the issue page shows):

What the class is. Every entry is a variant of the same design: the framework gives the model (or an authenticated user, or a WebSocket peer) a tool that runs code or shell on the server, and treats the model's choice to call it as authorisation. That is the PraisonAI / Flowise / Langflow pattern this corpus has filed a dozen times, now with a CNA-assigned id attached to each of five more projects. The practical difference from a "normal" CVE: there is no patch to pull, so the only remediations are architectural.

What this corpus does not know. Whether any maintainer disputes the reports; whether DeepTutor's and agent-zero's closed issues were closed as fixed, as by-design, or as stale; and whether Langflow's 1.10+ releases touched validate/code. Treat the version ranges as "reported against," not "known to end at."

Am I affected?

You are in scope if you self-host any of the six — including as a fork, a Docker image, or a "deploy this agent" template — and anyone other than you can reach its API or WebSocket.

# Which of these are installed, and at what version?
pip show agentscope langflow 2>/dev/null | grep -E '^(Name|Version):'
for d in devika DeepTutor DB-GPT agent-zero; do [ -d "$d" ] && (cd "$d" && git log -1 --format="$d %h %cd"); done
docker ps --format '{{.Image}}' | grep -iE 'devika|deeptutor|db-gpt|dbgpt|agentscope|agent-zero|langflow'

# Is the code-execution surface reachable? (any non-loopback bind = reachable)
ss -ltnp | grep -E ':(1337|3000|5000|5670|7860|8000|8080|8501)\b'
# agent-zero: is the file browser rooted at / ?
grep -n 'FileBrowser' -r agent-zero/python/helpers/file_browser.py 2>/dev/null | head -3
# AgentScope: is execute_python_code registered on any RealtimeAgent toolkit?
grep -rn 'execute_python_code' --include='*.py' . | grep -v site-packages | head
# Langflow: the endpoint exists on every version; what matters is who holds an API key / login
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:7860/api/v1/validate/code

If you are affected

1. Bind to loopback or a private network now, put authentication in front if the framework has none, and put the whole thing in a container or VM with no ambient cloud credentials — the model's code-execution tool runs as the service, so the service must own nothing you care about. → playbooks/if-your-local-ai-agent-was-exploited.md, prevention/agent-sandboxing.md
2. If an instance was internet-reachable: treat it as compromised, rotate every key in its environment and .env → playbooks/rotating-cloud-credentials.md, and audit the data it could read (DB-GPT and Langflow hold database and provider credentials by design).
3. Watch the issue links below rather than a CVE feed for the fix; MITRE records will not be updated when a maintainer merges something.

Prevention

• Model output is attacker input. A tool that executes code must sit behind an approval step the user takes, in a sandbox the framework does not control — never gated by the model's own decision to call it. prevention/agent-sandboxing.md
• For anything with a WebSocket or HTTP agent endpoint, the question "who can open a session?" is the whole security model; default binds and example docker run lines in READMEs are routinely 0.0.0.0 with auth off (see Obot in the MCP/agent batch).
• When you fork a research framework into a product, the "File browser rooted at /" and "trust_remote_code=True by default" class of convenience defaults ships with it; playbooks/auditing-a-vibe-coded-repo.md lists what to grep for first.

Update — 2026-10-04: thirteen more MITRE ids for the same reporter's gists landed on 10-01/02 — Devika ×3, Langchain-Chatchat ×3, SuperAGI ×4, AgentScope, Langflow — and a different reporter's VulDB record gives InternLM MindSearch a 9.3 with "the vendor … did not respond in any way"; HKUDS's other agent (Vibe-Trading) shows what the fixed version of this story looks like

The wave did not stop at eight. Between 2026-10-01 and 10-02 MITRE published thirteen further CVEs whose only references are gist.github.com/Ro1ME/… (plus, for Langflow, the already-tracked issue #13336). NVD carries a CVSS for only one of them (CVE-2026-51899, 4.3, from the CISA ADP); none names a fixed version or a maintainer reply.

InternLM MindSearch 0.1.0 — CVE-2026-105135 (CNA VulDB, published 2026-10-04, CVSS 4.0 9.3 / 3.1 10.0, CWE-74): "ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way." Reference is a gist by a different reporter (DReazer). Same class — a planner that executes model-generated code — different researcher, different CNA, same outcome: no fix, no reply.

The counter-example. HKUDS, the org behind DeepTutor (two ids above, issue unanswered), also publishes Vibe-Trading (vibe-trading-ai on PyPI), an LLM trading-agent framework. Its maintainers issued three vendor advisories on 2026-07-29 (database-reviewed 2026-10-02): GHSA-v2f8-6655-7grj (Critical, CVSS 3.1 9.8 / 4.0 10.0 — the auth dependency "returns immediately when API_AUTH_KEY is unset," leaving every endpoint open, with upload and an RCE-as-root chain), GHSA-jqmf-mx4f-hfr6 (Critical — "LLM-callable tools permit command execution, code injection, and SSRF") and GHSA-5rmq-chc7-m22f (High — file-read tools expose arbitrary server files); all fixed in 0.1.7. It is out of this corpus's audience as a trading bot, but it is the same org, the same class of bug, and the version of the process that ends with a fix line — which is why it is here as the contrast. Status of this file stays unconfirmed: twenty-one ids, one CVSS from a third party, zero maintainer statements.

Update — 2026-10-05: two more ids on 10-02 for a seventh framework, FinRobot 1.0.0 (CVE-2026-51917, CVE-2026-51918) — code injection in CodingUtils.modify_code and CodingUtils.create_file_with_code; VulnCheck's SiYuan and Heym ids are tracked elsewhere

The NVD keyword window for coding (10-02 → 10-05) surfaced two further cve@mitre.org records published 2026-10-02 against FinRobot 1.0.0 (AI4Finance Foundation's LLM financial-agent framework): CVE-2026-51917, "vulnerable to Code Injection in CodingUtils.modify_code," and CVE-2026-51918, "code injection in CodingUtils.create_file_with_code()." Both descriptions are one sentence, neither carries a score, neither names a fixed version, and the id block sits inside the same 5185x–5192x range as the rest of this wave, so this sweep lists them here rather than opening a new file; the gist references were not opened and no FinRobot issue was located. The pattern is the file's thesis in miniature — a helper that writes model-generated code to disk and runs it, reachable from a chat turn. Status unchanged (unconfirmed). The 10-04 and 10-05 VulnCheck ids for SiYuan (CVE-2026-105205) and Heym (CVE-2026-105396, HITL review-token leak via a spoofable Origin header, 5.3, fixed 0.0.112) belong to products already tracked in the MCP batch and are noted there by reference only.

Update — 2026-10-06: SuperAGI's share of the wave is six ids, not four — CVE-2026-51904 (9.8) and CVE-2026-51915 (9.8) for agent-execution and tool controllers that take a caller-supplied id without checking the organisation, CVE-2026-51914 (8.8, agent templates), CVE-2026-51901 (8.1, scheduling another organisation's agents), CVE-2026-51916 (7.5, deleting any knowledge object) and the 51899 (4.3) already listed; all against v0.0.14, all scored by CISA's ADP, none with a fix

The NVD keyword query for SuperAGI (published 2026-10-02) returns six cve@mitre.org records, and the database's agent recency listing shows GHSA entries for four of them on 10-02 (GHSA-63jh-v3gf-wqcq for 51904 among them). All six describe the same defect in different controllers of TransformerOptimus/SuperAGI "up to v0.0.14": an endpoint "accept[s] a caller-supplied agent_id" (or tool_id, or knowledge_id) "and fail[s] to verify organization ownership," so an authenticated user in one organisation acts on another's objects. The scores are CISA-ADP's, not the CNA's: CVE-2026-51904 9.8 (create_agent_execution / create_agent_run in controllers/agent_execution.py), CVE-2026-51915 9.8 (get_tool / update_tool), CVE-2026-51914 8.8 (save_agent_as_template / publish_template), CVE-2026-51901 8.1 (/api/agentexecutions/schedule), CVE-2026-51916 7.5 (POST /knowledges/delete/{knowledge_id}), CVE-2026-51899 4.3 (the five /api/agents/* controller endpoints). References are the reporter's gists and, for two of them, SuperAGI issues #1556 and #1557. Nothing names a fixed version; the project's last release predates the reports. Status unchanged (unconfirmed, single reporter, no vendor response); the SuperAGI block in the tools list above should be read as "≤ 0.0.14, six ids." These are multi-tenant authorization failures rather than the model-output-execution sink that is this file's thesis, and are kept here only because they belong to the same reporter's same-day batch.

Update — 2026-10-30: four more MITRE ids for the same reporter on 2026-10-29 — SuperAGI CVE-2026-51902, CVE-2026-51903, CVE-2026-51905 (cross-organisation reads) and agent-zero CVE-2026-51851 (file browser path traversal, 1.7 to 1.10)

Four cve@mitre.org records published 2026-10-29, each referencing a Ro1ME gist and a repository issue, no CVSS, no fixed version:

• SuperAGI v0.0.14, three ids. CVE-2026-51902: /api/agents/get/project/{project_id} returns another organisation's agent list to any authenticated user (issue #1558). CVE-2026-51903: get_agent_by_latest_execution in superagi/controllers/agent_execution.py returns another organisation's latest execution and agent metadata. CVE-2026-51905: get_agent_execution_configuration in agent_execution_config.py returns another organisation's execution configuration (issue #1559). With the six ids of 10-02 this makes nine SuperAGI records for one release, all the same missing organisation check in different controllers.
• agent-zero 1.7, 1.8, 1.9 and 1.10, CVE-2026-51851. python/helpers/file_browser.py:FileBrowser.save_text_file takes a caller path without normalisation, so a write lands outside the intended directory (issue #1541). It sits beside the two file-browser ids this file already carries from 09-30, which were reads rooted at /.

The database's agent listing shows all four as unreviewed rows dated 2026-10-29 with "Unknown" severity. Nothing here changes the file's status: the reporter's issues remain the only record, and no maintainer has named a fixed version for either project in anything read this run.

Sources for this update: CVE Services — CVE-2026-51902, CVE-2026-51903, CVE-2026-51905, CVE-2026-51851 — fetched 2026-10-30: CNA mitre, published 2026-10-29, the descriptions and the issue and gist references, no metrics, no versions beyond the description text; GitHub Advisory Database — agent listing — fetched 2026-10-30: the four rows.

Update — 2026-11-06: three VulDB ids for AgentScope 2.0.x from a different reporter (CVE-2026-123022, 123023, 123024); one fixed in 2.0.9, two with a pull request "awaiting acceptance"

VulDB published three records on 2026-11-05 against agentscope-ai/AgentScope 2.0.x, each referencing a GitHub issue filed on 2026-10-23 and a write-up in the reporter's ybyu-ieu/agent-security-advisories repository (not opened this run). All three print CVSS 4.0 6.9 and 3.1 7.3, VulDB's standard shape:

• CVE-2026-123022, subprocess.Popen in src/agentscope/mcp/_config.py (the MCP Workspace API): "manipulation of the argument command results in os command injection", remote, "the pull request to fix this issue awaits acceptance". Affected 2.0.0 through 2.0.11; 2.0.11 is PyPI's newest (2026-10-27).
• CVE-2026-123024, get_current_user_id in src/agentscope/app/deps.py (Agent Service): the X-User-ID header stands in for authentication, remote, same open pull request.
• CVE-2026-123023, check_permissions in src/agentscope/tool/_builtin/_bash.py (Bash Tool): incorrect authorization, "upgrading to version 2.0.9 mitigates this issue", patch commit 6b43b13a46401e86abd3defeed9a8bfe5b37bc6d; affected 2.0.0 through 2.0.8, PyPI dates 2.0.9 to 2026-09-28.

The pull request the two unfixed records name, #3448 (2026-10-23), adds an opt-in allowed_stdio_commands parameter to create_app() that rejects stdio MCP configurations whose command is not on the list; its author says it is a partial mitigation that "does not add authentication or sandboxing", and on 2026-11-06 it was open with no maintainer review. A merged opt-in allowlist would be mitigated for operators who set it, not a fix; an unmerged one is nothing. These are different bugs from the RealtimeAgent WebSocket issue in the table above (1.0.18 and 1.0.19, CVE-2026-51856) and from the 2.0.7.post1 LocalWorkspace traversal (CVE-2026-85685); AgentScope's advisory-database query now returns twenty-three rows across three reporters. The 2.0.x Agent Service and MCP Workspace API are HTTP surfaces; keep them off the network or behind your own authentication until a release carries the fix.

Sources

• CNA records for CVE-2026-123022, CVE-2026-123023 and CVE-2026-123024 (VulDB, 2026-11-05) read from cveawg.mitre.org on 2026-11-06; GitHub Advisory Database — agentscope query — fetched 2026-11-06: twenty-three AgentScope rows; agentscope-ai/agentscope pull request #3448 — fetched 2026-11-06: opened 2026-10-23, open, opt-in allowlist, no review; pypi.org/pypi/agentscope/json for the 2.0.9 (2026-09-28) and 2.0.11 (2026-10-27) dates.

• NVD API — CVE-2026-51871, CVE-2026-51872, CVE-2026-51870, CVE-2026-51866, CVE-2026-51856, CVE-2026-51853, CVE-2026-51852, CVE-2026-51886 — CNA cve@mitre.org, published 2026-09-30 (CVE-2026-51886 on 2026-10-01); descriptions, CVSS 3.1 scores where present (9.8 ×4, 7.5 ×1), and the issue/gist references quoted above. Queried 2026-10-01.

• stitionai/devika #714, agent0ai/agent-zero #1539, HKUDS/DeepTutor #506, eosphoros-ai/DB-GPT #3047, agentscope-ai/agentscope #1563, langflow-ai/langflow #13336 — the reporter's issues: open dates, open/closed state, labels, assignee, the DB-GPT fix PR #3071, and the absence of maintainer replies on Devika, agent-zero, DeepTutor and AgentScope. Fetched 2026-10-01.
• GitHub Advisory Database — agent, sorted by published date and llm — the 2026-09-30 unreviewed entries (GHSA-j6rq-qhh6-gpf5, GHSA-h2gv-ghr5-8mhj, GHSA-23c2-f3h2-xmcw, GHSA-pxxm-r9vp-9cmm, GHSA-4q5p-v9jh-hg59, GHSA-5656-fcv7-9pxx, GHSA-8v8q-vxfm-pcf6) with severity labels only. Fetched 2026-10-01.
• PyPI — agentscope release history — queried 2026-10-01: 1.0.18 (2026-03-26), 1.0.19 (04-20), 1.0.20 (05-15), 1.0.21 (05-25); latest 2.0.9. No release note read by this sweep mentions the RealtimeAgent path.
• 2026-10-05 update source — NVD API keyword window coding, 10-02 → 10-05 — CVE-2026-51917 and CVE-2026-51918 (FinRobot 1.0.0, cve@mitre.org, published 2026-10-02, no CVSS, no fixed version); CVE Services — CVE-2026-105396 (Heym, VulnCheck, 2026-10-05, 5.3, fixed 0.0.112).
• 2026-10-04 update sources — NVD API keyword window 10-01 → 10-04 and the Coder, LangChain, Langflow keyword queries — CVE-2026-51873/-51874/-51875 (Devika), -51882/-51883/-51884 (Langchain-Chatchat), -51886 (re-fetched: validate.py text now carries the ¶¶ duplicate description) and -51888 (Langflow 1.8.4, gist c85f513d), -51899 (4.3 CISA-ADP)/-51901/-51904/-51914 (SuperAGI), -51922 (agentscope 1.0.20), all cve@mitre.org published 2026-10-01/02; NVD API — CVE-2026-105135 (VulDB, 2026-10-04, 9.3 / 10.0, the "did not respond" sentence, gist by DReazer) and GHSA-4535-w5r2-pmqp; GitHub Advisory Database — agent, sorted by published date (SuperAGI ×4 and Devika ×2 entries dated 10-02 with severity "Unknown"); GHSA-v2f8-6655-7grj (Vibe-Trading, vendor 2026-07-29, 9.8 / 10.0, API_AUTH_KEY, ≥ 0.1.0 < 0.1.7 → 0.1.7) and the llm listing for the two sibling ids; langflow-ai/langflow advisory tab (walked 2026-10-04: newest 09-28, nothing for validate/code or knowledge_bases). All queried/fetched 2026-10-04.
• NVD API — keywordSearch=SuperAGI, published 2026-09-28 → 10-06 — fetched 2026-10-06: six records published 2026-10-02 (CVE-2026-51899, -51901, -51904, -51914, -51915, -51916), CNA cve@mitre.org, CVSS from the CISA-ADP container, descriptions and gist/issue references as quoted.
• GHSA-63jh-v3gf-wqcq — SuperAGI up to v0.0.14 contains an improper access control vulnerability (CVE-2026-51904) — fetched 2026-10-06: 9.8, unreviewed, the create_agent_execution / create_agent_run description, published 2026-10-02.