Ruvnet vulnerabilities
We track 3 vulnerabilities in Ruvnet products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 25, 2026.
Latest Ruvnet vulnerabilities
- 7.1 High severity
sublinear-time-solver: External Control of File Name or Path
sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the export_state and import_state tools in src/consciousness-ex
- 8.8 High severity
agentic-flow: Improper Neutralization of Special Elements used in an OS Command
Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated
- 10.0 Critical severity
ruflo: Improper Neutralization of Special Elements used in an OS Command
Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke