AI Sec Watch

A ReDoS vulnerability (regular expression denial of service, where specially crafted input causes a program to use excessive CPU by making the regex engine work inefficiently) was found in the Hugging Face Transformers library version 4.49.0, specifically in a function that reads configuration files. An attacker could send malicious input to make the application slow down or crash by exhausting its computing resources.

A ReDoS vulnerability (regular expression denial of service, where inefficient pattern matching causes a system to slow down or crash) was found in the Hugging Face Transformers library version 4.49.0. The problem is in a regex pattern called `SETTING_RE` that uses inefficient repetition, causing it to take exponentially longer when processing specially crafted input strings, which can make the application unresponsive or crash.

BerriAI litellm version 1.65.4 contains a SQL injection vulnerability (a type of attack where malicious SQL code is inserted into user inputs to manipulate database queries) in the /key/block endpoint. This weakness allows attackers to potentially access or modify database contents through this vulnerable endpoint.

The U.S. Senate voted 99-1 to remove a provision from a Republican bill that would have prevented states from regulating AI if they wanted to receive federal broadband expansion funds. The provision was weakened by Senate rules that limited it to only $500 million in new funding rather than $42.45 billion in total broadband funds, making it less likely states would comply even if it had passed.

A vulnerability exists in Anthropic's deprecated Slack MCP Server (Model Context Protocol Server, a tool that lets AI agents interact with Slack) that allows attackers to steal sensitive data. When an AI agent processes untrusted input, an attacker can trick it into creating messages with malicious links that, when Slack's link preview bots automatically expand them, secretly send private data to the attacker's server without requiring any user action.

The @cyanheads/git-mcp-server (an MCP server, or a tool that lets AI systems interact with Git repositories) has a command injection vulnerability (a flaw where attackers can sneak extra system commands into input) in versions before 2.1.5. Because the server doesn't check user input before running system commands, attackers can execute arbitrary code on the server, or trick an AI client into running unwanted actions through indirect prompt injection (hiding malicious instructions in data the AI reads).

CyberRisk Alliance and OWASP (Open Worldwide Application Security Project, a non-profit focused on improving software security) announced a partnership to advance education in application security (protecting software from attacks) and AI security. The collaboration will involve creating shared content, hosting events, and conducting research initiatives together.

CVE-2025-6855 is a critical vulnerability in Langchain-Chatchat (a tool built on LLMs) up to version 0.3.1 that allows path traversal (accessing files outside the intended directory) through manipulation of a parameter called 'flag' in the /v1/file endpoint. The vulnerability has been publicly disclosed and could potentially be exploited.

CVE-2025-6854 is a path traversal vulnerability (a flaw that lets attackers access files outside intended directories) in Langchain-Chatchat software versions up to 0.3.1, specifically in a file upload endpoint. The vulnerability can be exploited remotely by attackers with login credentials and has already been publicly disclosed.