{"data":{"id":"3744c776-562a-4b20-9cd1-739bcc975d42","title":"GHSA-g5f9-3xfg-p9mf: Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context","summary":"Decepticon is vulnerable to role-boundary forgery when web crawl results containing ChatML special-token literals (special symbols that mark conversation roles in LLM message formatting) are inserted into LLM messages without being neutralized. Attackers can plant malicious tokens in target web pages; when the recon agent scrapes these pages and feeds them to the LLM, the tokens trick the model into treating attacker input as a legitimate new instruction, bypassing security guardrails and enabling arbitrary command execution. The vulnerability affects all 16 specialist agents in Decepticon when using self-hosted or open-source LLM backends (like vLLM or SGLang) that don't filter these literals, though hosted services like OpenAI and Anthropic are currently immune because they strip the literals server-side.","solution":"OpenClaw completed an analogous fix on 2026-04-22 via commit `2514746b3261` (~30 lines, sanitizer applied just before tool-output wrapping), demonstrating the feasibility of application-layer mitigation. The source states that 'Fix responsibility falls squarely on the Agent application layer' and that a sanitizer should be applied 'just before tool-output wrapping' to neutralize special-token literals before they reach the LLM message composition layer.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-g5f9-3xfg-p9mf","publishedAt":"2026-09-24T19:17:49.000Z","cveId":"CVE-2026-61732","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["prompt_injection","jailbreak"],"issueType":"vulnerability","affectedPackages":["decepticon-sdk@<= 1.1.16 (fixed: 1.1.17)","decepticon@<= 1.1.16 (fixed: 1.1.17)","decepticon-core@<= 1.1.16 (fixed: 1.1.17)"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["Decepticon","vLLM","SGLang","Ollama","LM Studio","text-generation-webui","OpenAI","Anthropic","DashScope","Qwen","OpenClaw"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-09-24T19:17:49.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","safety"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051","AML.T0054"]}}