Junglewise Threat Intelligence

Duplicate Advisory: Knowns Sandbox Escape: Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem

Severity: low · CVSS 3.1 · Published 2026-09-10

Technologies: knowns (npm). Vendors: npm.

Executive brief

Duplicate Advisory: Knowns Sandbox Escape: Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem

Affected products

npm knowns

Related threats

Duplicate Advisory: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + M
knowns directory traversal in MCP tool path arguments