AI Sec Watch

NVIDIA Triton Inference Server for Windows and Linux has a vulnerability in its Python backend where an attacker can send a specially crafted request to cause an out-of-bounds write (writing data outside the intended memory location). This could allow remote code execution (running malicious commands on the system), denial of service (making the system unavailable), data tampering (changing data), or information disclosure (exposing sensitive information).

CVE-2025-23318 is a vulnerability in NVIDIA Triton Inference Server (a tool that runs AI models for predictions) on Windows and Linux where an attacker could cause an out-of-bounds write (writing data outside the intended memory location) in the Python backend component. If successfully exploited, this could allow an attacker to execute code, crash the system, change data, or steal information.

NVIDIA Triton Inference Server has a vulnerability in its HTTP server (CVE-2025-23317) where an attacker could send a specially crafted HTTP request to start a reverse shell (a remote connection giving the attacker control of the system). This could allow remote code execution (running commands on a system without permission), denial of service (making the system unavailable), data tampering, or information disclosure.

NVIDIA Triton Inference Server has a vulnerability (CVE-2025-23311) where an attacker can send specially crafted HTTP requests to cause a stack overflow (a memory error where too much data is written to a limited storage area). This could allow remote code execution (running malicious commands on the server), denial of service (making the server unavailable), information disclosure (leaking data), or data tampering (modifying stored information).

NVIDIA Triton Inference Server (software that runs AI models for prediction tasks) for Windows and Linux has a vulnerability where attackers can send specially crafted inputs to cause a stack buffer overflow (writing data beyond allocated memory limits), potentially leading to remote code execution (running commands on the affected system), denial of service (making the system unavailable), information disclosure, and data tampering. The vulnerability has a CVSS score (severity rating) of 4.0.

A ReDoS vulnerability (regular expression denial of service, where a specially crafted input causes a regex pattern to consume excessive CPU) exists in Hugging Face Transformers library version 4.51.3 and earlier, in a function that converts TensorFlow model weight names to PyTorch format. An attacker can exploit this with malicious input strings to crash services or exhaust system resources.

Devin AI, a tool that acts as an AI software engineer, is vulnerable to prompt injection (tricking an AI by hiding malicious instructions in its input) attacks that can lead to full system compromise. By planting malicious instructions on websites or GitHub issues that Devin reads, attackers can trick it into downloading and running malware, giving them remote control over Devin's DevBox (the sandboxed environment where Devin operates) and access to any stored secrets.

Amp, an AI coding agent by Sourcegraph, had a vulnerability where it could modify its own configuration files to enable arbitrary command execution (running any code on a developer's machine) through two methods: adding bash commands to an allowlist or installing malicious MCP servers (external programs the AI can invoke). This could be exploited by the AI itself or through prompt injection attacks (tricking the AI by hiding malicious instructions in its input).

LibreChat (a ChatGPT-like application) versions 0.0.6 through 0.7.7-rc1 have a vulnerability where an exposed testing endpoint called /api/search/test allows anyone to read chat messages from any user by directly accessing the Meilisearch engine (a search database) without proper permission checks. This is a serious security flaw because it exposes private conversations.