Known attacks
Which published attacks on coding agents depend on something a repository file can carry, and what cfgaudit reports for that file. cfgaudit detects the configuration an attack depends on, not the bug behind it. Most of these CVEs are agent bugs fixed in a release, so a finding means the file has the shape the attack used, not that a current agent is vulnerable.
57 are detected, 17 partly, and 7 are not, each with the reason. Every listed rule and severity is checked against a fixture in cfgaudit's tests. Bugs in servers and model behaviour are left out, because no configuration file shows them.
Detected
-
Trojan Source: bidirectional Unicode controls make text read differently to a person than to a parser.
-
A prompt injection tells the agent to widen its own permission settings.
-
A web page can reach an older MCP Inspector's local proxy and run commands through it.
-
An agent write to .roo/mcp.json adds an MCP server.
A file scan cannot see this part: it needs run-time state. cfgaudit reports a committed server with an inline script. A write at run time is invisible to a scan.
-
An agent write to .vscode/settings.json points an executable-path setting at a program of the attacker's choice.
-
A committed setting turns off every tool confirmation in Copilot Chat.
-
An agent write to .vscode/settings.json changes the terminal profile to a program inside the repository.
-
CurXecute: prompt injection makes the agent create a .cursor/mcp.json whose server runs a command.
A file scan cannot see this part: it needs run-time state. cfgaudit sees the committed file. A file the agent writes at run time is invisible to a scan.
-
MCPoison: an approved MCP server in a committed .cursor/mcp.json is swapped for another command without a new approval.
A file scan cannot see this part: it needs run-time state. cfgaudit reports the swapped command. The approval state lives in the editor.
-
A symlink inside the workspace leads a write outside it.
-
A .code-workspace file written by the agent runs tasks when the workspace is reopened.
-
Symlinks bypass .rooignore and reach excluded files.
-
Committed hooks and MCP settings ran before the trust dialog.
-
A committed Yarn config ran repository JavaScript when the agent called yarn before the trust dialog.
-
A case variant of a sensitive path passes the guard on a case-insensitive filesystem.
A file scan cannot see this part: it needs run-time state. cfgaudit reports a committed command that writes such a path. The guard itself runs in the agent.
-
A project config declares an MCP server that starts without confirmation.
-
Settings written into a .code-workspace file bypass the .vscode/settings.json protection.
-
A committed .cursor/cli.json allowlists shell commands.
-
A case-variant path bypasses the guard on .cursor/cli.json.
A file scan cannot see this part: it needs run-time state. cfgaudit reads the case variant. The guard itself runs in the agent.
-
A committed .cursor/mcp.json server starts in Cursor CLI as soon as the folder opens.
A file scan cannot see this part: it needs run-time state. An ordinary command in the file is not a finding on its own: cfgaudit cannot tell a harmless server from a harmful one.
-
Second record of the Yarn config issue: repository JavaScript ran before the trust dialog.
-
A malicious server's response ran commands through the stdio proxy.
-
A committed language-server binary setting runs a program of the repository's choice once the worktree is trusted.
A file scan cannot see this part: it needs run-time state. cfgaudit reports inline scripts and interpreter flags. A plain path to a program is not reported.
-
A committed context server runs an inline shell once the worktree is trusted.
-
An instruction gave the agent a destructive goal in prose.
-
An agent environment sanitizer left runtime start-up hooks in place, so a configured variable loaded code.
-
A workspace setting sends the Azure DevOps token to an endpoint the repository chooses.
-
Workspace settings register custom hook and agent folders the agent could edit without approval.
-
An untrusted project's MCP configuration leads to code execution.
-
In untrusted folders a committed .gemini/.env was loaded.
-
A symlink in a workspace leads a file write outside the trust boundary.
-
A project .env overrides GEMINI_CLI_HOME, so Gemini CLI reads user configuration from a folder the repository supplies.
Deliberately not reported. cfgaudit reports the variable in .gemini/.env but does not read a root .env, which is an ordinary project file far more often than agent config.
-
Automated git operations trusted a repository-local hooks path.
-
Metadata collection ran a repository-local core.fsmonitor.
-
Git status on a preserved .git/config activated a filter driver.
-
Opening a folder started source control integration before any trust decision.
-
A committed .vscode/mcp.json server started without the workspace being trusted.
A file scan cannot see this part: it needs run-time state. cfgaudit reports inline scripts. An ordinary server command in the file is not a finding on its own.
-
A workspace setting makes the terminal type a reply by itself when a pattern appears.
-
A committed base URL sends API requests, and the key, to another endpoint before the trust dialog.
-
A permission deny rule could be bypassed by reading the denied file through a workspace symlink.
Deliberately not reported. A link that stays inside the repository and points at a denied file is not reported.
-
Agent file tools follow a committed symlink out of the worktree.
-
A templated credential is forwarded to a cleartext or raw-IP MCP endpoint.
-
An MCP server configured with a wildcard CORS origin answers requests from any web page.
-
A committed bypassPermissions default skipped the trust dialog.
-
A symlink created by a sandboxed process lets the unsandboxed agent write outside the workspace.
A file scan cannot see this part: it needs run-time state. cfgaudit reports a committed link of this shape. A link the agent creates at run time is invisible to a scan.
-
A crafted .git file pointing at a trusted path skipped the trust dialog.
A file scan cannot see this part: it needs run-time state. cfgaudit reports the committed hook. The trust check runs in the agent.
-
An HTTP MCP server without log redaction writes secrets to its logs.
-
An HTTP MCP server without log redaction writes secrets to its logs.
-
An environment variable name carrying a command substitution ran when Zed built a remote terminal command.
-
Plugin component paths leave the plugin root.
-
An interpreter start-up variable in an MCP server env block loads code when the server starts.
-
A committed nested bare repository runs a git command key when the agent uses git inside it.
-
A committed .code-workspace sets a remote authority that connects the extension host to another server.
-
Copilot debug settings send requests and the token to an upstream the repository chooses.
-
A .gitmodules URL with a lookalike host received the GitHub credential on submodule update.
-
The action read .mcp.json from a checked-out pull request head.
-
Cursor ran hook commands from a workspace .claude/settings.local.json without approval.
A file scan cannot see this part: it needs run-time state. cfgaudit reports the committed hook. The missing approval is in the editor.
-
A failed path check lets the agent write through a symlink outside the workspace.
A file scan cannot see this part: it needs run-time state. cfgaudit reports a committed link of this shape. A link the agent creates at run time is invisible to a scan.
-
A browser flag in an MCP server's arguments runs a program as the browser subprocess.
-
MCP servers from a repository .mcp.json start without confirmation.
-
An extension recommendation link runs a task in a restricted workspace.
A file scan cannot see this part: it needs run-time state. cfgaudit reports lookalike extension ids. The notification link is built by the editor.
-
A git.exe at the repository root is planted in place of the real git on Windows.
-
A recommendation's text becomes a command link in the install-error notification.
A file scan cannot see this part: it needs run-time state. cfgaudit reports lookalike extension ids. The notification link is built by the editor.
-
A restricted setting in nested-object form skipped the Restricted Mode filter.
-
A committed nested bare repository runs a git command key when the agent uses git inside it.
-
A wrapper replacing a virtual environment's interpreter later ran outside the sandbox.
-
Workspace settings connect the editor to another agent host and grant it local file access.
-
Nested-object settings that connect the editor to another service skipped Restricted Mode.
-
A workspace setting sends the Azure DevOps token to an endpoint the repository chooses.
-
A recipe's stdio extension runs commands without inspection.
-
A git.exe committed at the project root ran in place of the real git on Windows.
-
A project MCP configuration runs a command, and planted tools shadow fd and stty.
Deliberately not reported. The MCP step and a Windows program named fd or stty at the root are reported; a script without a Windows suffix is not, since it only runs when the working directory is on PATH.
-
A command rewrites the agent's own settings, which survive cleanup and re-enable themselves.
-
A remote MCP server's OAuth endpoint ran a command on Windows and WSL when Inspector connected.
Not detected
-
The always-allow setting turned off per-tool approval.
Deliberately not reported. Zed drops this key from a committed project settings file, so the file has no effect today.
-
A workspace setting adds terminal link schemes, skipping the warning before a link opens a protocol handler.
Deliberately not reported. The setting widens what a click may open and approves nothing the agent does.
-
MCP sandbox grants in the shared root of mcp.json applied to every server in the file.
A file scan cannot see this part: it needs run-time state. The sandbox schema has not been measured yet, so the grants are not read.
-
A command key in a distributed repository's own .git/config ran when the folder opened.
Visible in a file, but no rule covers it yet. Issue #1408.
-
An injected agent writes a .github/agents file whose frontmatter hooks run shell commands.
A file scan cannot see this part: it needs run-time state. A hook with an ordinary command is not a finding on its own, and the write itself happens at run time.
-
A plugin install checked out a pinned SHA without verifying that the result was that commit.
A file scan cannot see this part: it needs run-time state. The check belongs to the installing client. A pin looks the same either way.
-
cfgaudit's own advisory: a symlink made the scanner read a file outside the repository and quote it in a report.
Deliberately not reported. A bug in cfgaudit, fixed in v1.17.1. It is listed because CFG115 cites it.
Campaigns
A campaign is a chain of steps, so this section says which step cfgaudit sees.
-
Agent skills
ClawHavoc
detectedPublished skills tell the reader to run an install step that fetches a payload.
- Skill text asks for a download and run: CFG036
-
VS Code
Contagious Interview
detectedA task that runs when a folder opens starts the payload of a fake interview repository.
- Task runs on folder open: CFG047
-
npm and MCP
SANDWORM
partly detectedPackages plant git hooks and CI workflows and add an MCP server to agent configs.
- Git hook and CI workflow planted: A file scan cannot see this part: it needs run-time state.
- MCP server added to agent settings: CFG052, CFG127
A file scan cannot see this part: it needs run-time state. The planted git hook and CI workflow are outside agent configuration. CFG127 detects the correlated hidden-home MCP entry statically but cannot inspect runtime tool descriptions.
-
npm and MCP
postmark-mcp
detectedA malicious npm package impersonated Postmark's MCP server and copied sent email to an external recipient.
- MCP server launched from the exact malicious version: CFG128
-
Nx users
s1ngularity
partly detectedA compromised npm package used installed AI CLIs with bypass flags to search the machine.
- Package install script runs: A file scan cannot see this part: it needs run-time state.
- Agent CLI started with a bypass flag: CFG125
A file scan cannot see this part: it needs run-time state. The package itself is out of reach. cfgaudit sees the same flags only in a committed agent config.
From docs/advisories.yml of cfgaudit 1.21.0.