AI Sec Watch

Langflow contains a vulnerability in its eval_custom_component_code function that allows attackers to execute arbitrary code (RCE, or remote code execution) without needing to log in. The flaw occurs because the function doesn't properly validate user input before executing it as Python code, letting attackers run any commands they want on the affected system.

Langflow has a critical vulnerability where attackers can execute arbitrary code (commands) on the server without needing to log in, by sending malicious input to the validate endpoint. The flaw occurs because the code parameter is not properly checked before being run as Python code, allowing an attacker to run commands with root-level permissions (the highest system access level).

Ollama MCP Server contains a command injection vulnerability (a flaw where an attacker can insert malicious commands into user input that gets executed) in its execAsync method that allows unauthenticated attackers to run arbitrary code on the affected system. The vulnerability exists because the server doesn't properly validate user input before passing it to system commands, letting attackers execute code with the same privileges as the service running the server.

MCP Manager for Claude Desktop has a vulnerability where attackers can inject malicious commands into MCP config objects (configuration files that tell Claude how to use external tools) that aren't properly checked before being run as system commands. By tricking a user into visiting a malicious website or opening a malicious file, an attacker can break out of the sandbox (the restricted environment that limits what Claude can access) and run arbitrary code (any commands they want) on the computer.

A vulnerability in gemini-mcp-tool's execAsync method allows attackers to run arbitrary code (RCE, or remote code execution) on systems using this tool without needing to log in. The flaw occurs because the tool doesn't properly check user input before running system commands, letting attackers inject malicious commands.

CVE-2026-24307 is a vulnerability in Microsoft 365 Copilot where improper validation of input (failure to check that data matches what the system expects) allows an attacker to access and disclose information over a network without authorization. The vulnerability has a CVSS score of 4.0 (a moderate severity rating on a 0-10 scale).

CVE-2026-21521 is a vulnerability in Microsoft Copilot where improper handling of escape sequences (special characters used to control how text is displayed or interpreted) allows an attacker to disclose information over a network without authorization. The vulnerability is classified as CWE-150 (improper neutralization of escape, meta, or control sequences) and was reported by Microsoft Corporation.

CVE-2026-21520 is a vulnerability in Microsoft Copilot Studio that allows an unauthenticated attacker to view sensitive information through a network-based attack. The vulnerability stems from improper handling of special characters in commands (command injection, where attackers manipulate input to execute unintended commands), and affects Copilot Studio's hosted service.

Typebot, an open-source chatbot builder, has a vulnerability in versions before 3.13.2 where malicious chatbots can execute JavaScript (code that runs in a user's browser) to steal stored credentials like OpenAI API keys and passwords. The vulnerability exists because an API endpoint returns plaintext credentials without checking if the person requesting them actually owns them.