CISA: Sentry Seer issues lead to coding-agent code execution
51st article in the last 90 days, one of 607 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues alert on MLflow pickle deserialization control bypass (Sep 2026).
Companies mentioned
Best suited for
- Seniority
- Director
- Job function
- Cybersecurity / Information Security
- Persona
- Security Operations Leader
- Buyer role
- Decision Maker / Budget Holder
- Buyer journey
- Need to Buy
- Adoption curve
- Early Majority
- Technology maturity
- Market Correction
- Industry
- Information Technology / Software & Services / Cybersecurity / Application Security & DevSecOps (SAST/DAST/SCA/Supply Chain)
Our classification, not the publisher's statement. Best suited for, not only for.
A vulnerability in Sentry Seer can enable arbitrary code execution within a coding-agent environment and access to connected source repositories when Seer is configured to automatically hand issues to a coding agent for remediation. The issue is tracked as CVE-2026-90999.
Successful exploitation occurs in a workflow where Sentry ingests attacker-generated exception events submitted through a public DSN. Seer determines whether the event is eligible for automated remediation, then generates a root-cause analysis that incorporates attacker-controlled event fields, including exception messages, stack traces, source context, and breadcrumbs. Seer embeds this analysis directly into the initial prompt given to the coding agent. The coding agent treats the generated analysis as a legitimate description of the victim’s codebase, downloads and executes a package controlled by the attacker, and executes it within the coding-agent environment before any human review of a pull request.
Successful exploitation may allow arbitrary code execution in the coding-agent environment that processes the affected repository.
At the time of this writing, no vendor-supplied patch information has been provided. Mitigations described include disabling automated remediation flows, restricting coding-agent package installation, or disabling Seer handoff until a fix is available, along with additional defensive filtering of telemetry content before Seer analysis to reduce risk.
Guidance provided with the advisory includes acknowledging reporting by Nikita Benkovich and Vitalii Valkov (agyn) and noting that the document was written by Bob Kemerer.
Blog post, originally published by Bob Kemerer at kb.cert.org.