Skip to content
The Injection_
LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

Plugins and extensions

Also called: extensions · add-ons

Plugins and extensions add commands, tools or integrations to AI assistants and coding agents. They run with the host's trust and often its access, so a malicious, compromised or vulnerable plugin can execute code, read secrets or steer the agent.

How it works

Risk comes from plugins that run code when installed or loaded, auto-install from repo configuration, request broad permissions, or fetch updates from places an attacker can control. In coding agents, a repo can sometimes declare plugins that load without the user noticing.

How to defend

Disable automatic plugin installation from project files, review plugin permissions, prefer signed or vetted marketplaces, and keep plugin lists short.

Real cases 3 stories

  1. MED

    Vulnerability · VulnCheck · CVE-2026-108865 · CVSS 8.8

    MCP source review: at least 16 unpatched CVEs in three days

    A static source-review campaign by two researchers has produced at least 16 MCP CVEs published October 10 to 12, 2026. The second wave reaches application MCP servers, an inference server sandbox and sub-agent permissions. None lists a fix.

  2. MED

    Vulnerability · GitHub Advisory Database · CVE-2026-108757 · CVSS 7.1

    Nexting pinclaw: an unauthenticated route injects prompts into an agent

    Nexting's pinclaw plugin skips its token check on POST /pinclaw/send, so an unauthenticated caller on the same network can inject prompts into a user's main OpenClaw agent session. No fixed version is available.

  3. HIGH

    Vulnerability · AIR Security

    Plugin4Shell: zero-click plugin RCE in four AI coding agents

    Plugin4Shell is a zero-click remote code execution flaw in how Claude Code, Codex, GitHub Copilot and Gemini CLI install pinned plugins. AIR says Claude Code and Codex are fixed, Copilot is not, and Gemini CLI will not be patched.