Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-90999 – Prompt Injection Leading to Remote Code Execution – Sentry Seer (AI Debugging Assis

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-90999 is a critical (CVSS 9.8) trust-boundary violation in Sentry Seer, Sentry’s AI-powered debugging assistant. When Seer is configured to automatically hand off issues to a connected coding agent for remediation, an unauthenticated attacker can submit a fabricated error event through a project’s public DSN (Data Source Name) and have it processed as legitimate developer context, ultimately causing the coding agent to download and execute attacker-controlled code with the privileges of the automation environment.

Technical details

  • Root cause: Sentry projects commonly expose a public, write-only DSN in client-side JavaScript so browsers can submit error telemetry. This endpoint accepts events without authentication, and Seer’s downstream analysis pipeline does not adequately separate untrusted event data from trusted instructions before embedding it into prompts sent to an integrated coding agent.
  • Trigger conditions: The target project must have Seer enabled with automatic (or developer-invoked) handoff of issues to a connected coding agent (e.g., Claude Code, Cursor, Codex-style integrations). No valid Sentry account, repository access, or infrastructure credentials are required by the attacker.
  • Attack vector: An attacker crafts an exception event whose message/stack trace/breadcrumbs mimic Sentry’s own issue formatting, including a fabricated "root cause" or "resolution" section containing a malicious package-install command, and submits it directly to the project’s public ingest endpoint using the exposed DSN.
  • Impact: When Seer generates its root-cause analysis from the poisoned event and passes it to the coding agent, the agent interprets the attacker’s fabricated instructions as legitimate remediation guidance and executes attacker-controlled packages/commands. This can result in arbitrary code execution within the coding agent’s environment and unauthorized access to connected source repositories, with no phishing, credential theft, or breach of the victim’s own account required.

Affected software

  • Sentry Seer, when a project’s Seer configuration is set to automatically (or interactively) hand off issues to an integrated coding agent for remediation.
  • Any deployment exposing a public/front-end DSN for browser-side error submission is exposed to the injection step of this attack chain, regardless of self-hosted or SaaS Sentry deployment.

Severity

  • CVSS v3.1 Base Score: 9.8 (Critical)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

  • Immediate: No official patched version has been published for this issue as of this writing. Disable automated (unattended) Seer-to-coding-agent handoff so that a human reviews AI-generated root-cause analyses and remediation steps before any code or package is executed.
  • If no patch is available:
    • Restrict or sandbox the coding agent’s ability to install/execute packages without explicit human approval.
    • Rotate exposed DSNs where feasible and avoid shipping DSNs directly to browsers; instead proxy error submission through a server-side endpoint you control.
    • Apply defensive filtering/sanitization of inbound telemetry content before it reaches Seer’s analysis pipeline.
    • Monitor coding-agent activity for unexpected package installs or command execution triggered by "fix this issue" workflows tied to Sentry issues.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge