AI Sec Watch

CVE-2025-51480 is a path traversal vulnerability (a flaw where attackers use special sequences like '../' to access files outside intended directories) in ONNX 1.17.0's save_external_data function that allows attackers to overwrite arbitrary files by supplying malicious file paths. The vulnerability bypasses the intended directory restrictions that should prevent this kind of file manipulation.

CVE-2025-51863 is a self XSS (cross-site scripting, where an attacker tricks a user into running malicious code on a website by injecting it into the page) vulnerability in ChatGPT Unli that was present through May 26, 2025. The vulnerability allows attackers to execute arbitrary code (run any commands they want) by uploading a specially crafted SVG file (a type of image format) to the chat interface.

Chaindesk has a stored XSS vulnerability (cross-site scripting, where malicious code is saved and runs in users' browsers) in its chat feature through May 26, 2025. An attacker can trick the AI agent's system prompt (the instructions that control how an LLM behaves) to output harmful scripts that execute when users view conversations, potentially stealing session tokens (security credentials that prove who you are) and taking over accounts.

CVE-2025-49747 is a missing authorization vulnerability (a flaw where a system fails to properly check if a user has permission to perform an action) in Azure Machine Learning that allows someone who already has some access to the system to gain elevated privileges, or higher levels of access, over a network.

CVE-2025-49746 is a vulnerability in Azure Machine Learning where improper authorization (CWE-285, a flaw in how the system checks who is allowed to do what) allows someone who already has legitimate access to gain higher-level privileges over a network. This is categorized as a privilege escalation attack, where an authorized user exploits a weakness to gain permissions they shouldn't normally have.

CVE-2025-47995 is a vulnerability in Azure Machine Learning that involves weak authentication (a system that doesn't properly verify user identity), allowing someone who already has some access to gain elevated privileges (higher-level permissions) over a network. The vulnerability has a CVSS 4.0 severity rating, though a full assessment from NIST has not yet been provided.

Meta's new Llama 4 models (Scout and Maverick) were tested for security vulnerabilities using Protect AI's Recon tool, which runs 450+ attack prompts across six categories including jailbreaks (attempts to make AI ignore safety rules), prompt injection (tricking an AI by hiding instructions in its input), and evasion (using obfuscation to hide malicious requests). Both models received medium-risk scores (Scout: 58/100, Maverick: 52/100), with Scout showing particular vulnerability to jailbreak attacks at 67.3% success rate, though Maverick demonstrated better overall resilience.

GPT-SoVITS-WebUI, a tool for voice conversion and text-to-speech, has an unsafe deserialization vulnerability (CWE-502, a weakness where untrusted data is converted back into executable code) in versions 20250228v3 and earlier. The vulnerability exists in process_ckpt.py, where user input for a model file path is passed directly to torch.load without validation, allowing attackers to potentially execute arbitrary code. The vulnerability has a CVSS score (severity rating) of 8.9, indicating it is highly severe.

CVT-2025-49840 is an unsafe deserialization vulnerability (CWE-502, a security flaw where a program processes untrusted data without checking it first) in GPT-SoVITS-WebUI, a tool for voice conversion and text-to-speech. In versions 20250228v3 and earlier, the software unsafely loads user-provided model files using torch.load, allowing attackers to potentially execute malicious code. The vulnerability has a CVSS score (severity rating) of 8.9, indicating high risk.