AI Sec Watch

IBM Langflow OSS versions 1.0.0 through 1.10.0 and Langflow 1.9.0 contain a vulnerability that allows SSRF (server-side request forgery, where an attacker tricks a server into making requests to unintended targets) because of unsafe default settings and incomplete protection mechanisms against this type of attack. The vulnerability has a CVSS 4.0 severity rating, though a full assessment from NIST has not yet been provided.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 has a vulnerability where an authenticated attacker (someone with login access) can create a malicious flow pointing to a URL they control, which returns a specially crafted header that tricks the system into writing files to any location on the server. This works because the system doesn't properly validate file paths, allowing an attacker to use path traversal (using sequences like '../' to escape the intended directory) to write files anywhere the Langflow process can access.

IBM Cognos Analytics version 12.1.3 GA through build 12.1.3-2606251736 has a race condition (a bug that occurs when multiple processes access shared data simultaneously without proper protection), allowing attackers to get incorrect report summaries or cause report-processing failures when multiple authenticated users submit reports at the same time.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 has a vulnerability where authenticated users (those who have logged in) can run arbitrary commands (any code they choose) with elevated privileges (higher access level) due to improper validation of user input in the Python Interpreter component (the part that executes Python code). The vulnerability stems from OS command injection (CWE-78, where attackers embed malicious system commands in their input), allowing attackers to bypass security checks.

IBM Langflow OSS (an open-source tool for building AI workflows) versions 1.0.0 through 1.10.1 have an unauthenticated remote code execution vulnerability (RCE, where attackers can run commands on the system without logging in) in a public endpoint. The vulnerability exists because the validate_public_flow_no_code_execution() function (a safety check) has an incomplete denylist (a list of things to block) that fails to block certain agent components like OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent from executing code.

AWS HealthOmics MCP Server versions 0.0.35 and earlier contain a path traversal vulnerability (a flaw where attackers can use special directory notation like '../' to access files outside intended locations) in its workflow linting tools. An attacker who can control inputs to the MCP agent could write malicious files to any location on the system instead of just the workflow bundle directory.

TikTok is testing an opt-in tool that detects AI-generated copies of creators (deepfakes, or AI-altered versions of real people) and allows creators to report them to the company. The tool is currently available to some US creators who verify their identity through Jumio, a third-party identity verification service, using a selfie scan and ID check.

A security flaw in mcp-memory-keeper allowed arbitrary local file reads through the `context_import` function, which didn't validate file paths before reading them. An attacker (either a malicious client or an LLM agent affected by prompt injection, a technique where hidden instructions are embedded in AI inputs) could read any file accessible to the server process, including credential files and configuration files, or view partial file contents through error messages.

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a code injection vulnerability (a type of security flaw where attackers insert malicious code) in the ToolGuard integration that allows authenticated users to bypass the allow_custom_components=false security control and execute arbitrary Python code on the backend. The vulnerability exists because the validation system only checks the main component code but misses dynamic CodeInput fields, and attackers can exploit this by embedding malicious code in these unvalidated fields that get executed when tools are invoked. The flaw can be made worse through cross-tenant flow manipulation (exploiting flows across different user accounts) when certain security settings are misconfigured.