al-ice.ai

Fifty-Two Registered Wounds: Counting Prompt Injection in the NVD Shows Where Agents Actually Break

AI Security Research by al-ice.ai Editorial

Everyone quotes the same two prompt-injection numbers — OWASP ranks it first in the LLM Top 10, and “most models are vulnerable” — and neither tells you how often it becomes a registered vulnerability. A census published 8 November 2026 by Gökhan Köse of promptinjections.de does the counting: 52 CVEs in LLM and agent software where prompt injection is the cause or the consequence, listed in the NVD between January and 6 November 2026, with the full list, NVD links, and machine-readable data released CC BY 4.0. The shape of the 52 is more useful than the number: 6 critical (CVSS 9.0+), 32 high, 13 medium, 1 low, median base score 8.0 — and the weakness table reads like a classic-vulnerability greatest-hits album with prompt injection as the opening act. Injection gets the CVE title; SSRF, deserialization, and missing authorization do the damage.

The curve bends in autumn — partly because the counting got better

The timeline runs 1 in January, 2 in May, 3 in July, 10 in August, 13 in September, 23 in October — a curve the author is honest enough to partially discount. Since September the project also queries the NVD monthly for “prompt injection,” so the autumn jump mixes real growth with better retrieval, and the early months are under-counted rather than quiet. That candor is exactly what makes the dataset usable: stated method beats a clean-looking chart. The direction still matters for defenders — October alone produced nearly half the year’s total — and it rhymes with what this site’s own autumn coverage shows, from the Radware indirect-prompt-injection census of coding agents to the CrowdStrike planning-stage taxonomy and the MITRE ATT&CK v20 AI techniques. The field spent 2026 learning that agents act on untrusted text; the CVE record is now catching up to that lesson.

Where the 52 live: coding agents, gateways, MCP servers

By product type, coding agents lead with 8, followed by AI gateways/proxies (6) and MCP servers (6) — the three surfaces where untrusted content meets tool authority. Inference infrastructure contributes 4, agent frameworks 3, browsers with built-in assistants 3, and the remaining 20 entries are singletons across twenty product types, which the author reads correctly: the attack surface is wide, not concentrated. That spread is the quantitative counterpart to stories we have covered one by one — the Junie prompt-injection bypass batch, the seven-CVE MCP reference-server batch, gateway-shaped flaws like the IntentKit tool-gate bypass. The census says these are not anecdotes; they are the plurality class of registered agent vulnerability. One sample entry shows the texture: CVE-2026-37006, code execution through the gpt-researcher agent’s WebSocket endpoint.

CWE-918 on top: injection is the entry point, not the whole bug

The weakness ranking is the most defensive-useful table in the release. CWE-918 (server-side request forgery) leads with 7, then CWE-436 (interpretation conflict, 5), with CWE-502 (deserialization), CWE-862 (missing authorization), and CWE-94 (code injection) at 4 each. The author’s gloss is the takeaway to internalize: prompt injection rarely stands alone in a CVE; it is the entry point to a classic bug. The model obeys the text, and then a conventional flaw — an SSRF-able fetcher, an unsafe deserializer, a missing auth check — converts obedience into impact. That reframes the fix priority: input-side prompt defenses matter, but the CVEs close at the classic layer, with output-side least privilege and tool-side authorization. A fenced prompt feeding an SSRF-capable tool is still an SSRF vulnerability wearing an agent costume.

What to actually do

  1. Pull the dataset instead of the headline: JSON and CSV on GitHub, a stable /api/v1/cves.json endpoint, a citable DOI (10.5281/zenodo.24054569), and Hugging Face and Kaggle mirrors — all CC BY 4.0. Filter the 52 by your own stack (coding-agent fleet? gateway? MCP servers?) and check whether your versions are in the affected ranges before the next planning cycle.
  2. Weight by the weakness table, not the injection label: if you run gateway, proxy, or tool-server software, audit for CWE-918, CWE-502, CWE-862, and CWE-94 behind the prompt surface. The CVE record says those are where prompt injection cashes out.
  3. Treat the timeline as a floor, not a trendline: pre-September months are under-counted by the author’s own account, so “only a handful before August” is a retrieval artifact. Baseline your threat model on the October run-rate and the 8.0 median severity, not the quiet spring.
  4. Pair the census with adjacent primary-backed work: the GitHub code-scanning preview for AI applications for detection-side tooling, and the site’s gateway/MCP coverage above for the fix patterns that actually closed these classes of bugs.

Our verification was read-only. We read the dev.to write-up first-hand (Gökhan Köse, 8 November 2026, AI-assisted, originally published at promptinjections.de, author-disclosed as the site’s publisher) and then verified every headline number against the live dataset API first-hand (/api/v1/cves.json, version 2.2.0, stand 2026-11-06, CC-BY-4.0, machine-checked against NVD): 52 entries; severity counts 6/32/13/1 with median 7.95; timeline 1/2/3/10/13/23 for Jan/May/Jul/Aug/Sep/Oct; product-type leaders coding agents 8, gateways 6, MCP servers 6, inference 4, frameworks 3, browsers 3; CWE leaders 918×7, 436×5, 94/502/862×4 — all matching the article. We confirmed the DOI, mirror, and license metadata in the API response. We did not re-audit individual NVD records beyond the sample entry’s NVD link. Brave Search was used for discovery only.

Sources: