Arduino vulnerabilities
We track 6 vulnerabilities in Arduino products across 4 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on December 18, 2025.
Latest Arduino vulnerabilities
- 7.3 High severity
arduino-ide: Incorrect Default Permissions
Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with world-writable file permissions on sensitive application components, allowing any local user to replace legitimate files with malicious code.
- 9.9 Critical severity
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and…
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI is vulnerable to multiple Poisoned Pipeline Execution (PPE) vulnerabilities. Code injection in `tests_results.yml` work
- 7.1 High severity
arduino-create-agent: Improper Limitation of a Pathname to a Restricted Directory
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the loca
- 7.8 High severity
arduino-create-agent: Insufficient Verification of Data Authenticity
Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration
- 7.1 High severity
arduino-create-agent: Improper Limitation of a Pathname to a Restricted Directory
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the loca
- 7.8 High severity
arduino-create-agent: Improper Limitation of a Pathname to a Restricted Directory
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles request with the `filename` parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is a