{"data":{"id":"3744c776-562a-4b20-9cd1-739bcc975d42","title":"GHSA-g5f9-3xfg-p9mf: Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context","summary":"Decepticon composes web crawl output into LLM messages without neutralizing ChatML special-token literals, so a string planted in a target web page can forge a new operator turn that the model treats as authoritative. Under a BYOK OpenAI-compatible backend whose tokenizer preserves special-token IDs (confirmed with vLLM, SGLang and TGI), this bypasses agent guardrails and enables arbitrary command execution in the Kali Linux sandbox. Confirmed in v1.1.4 across all 16 specialist agents.","solution":"N/A -- no mitigation discussed in source.","labels":["security","safety"],"sourceUrl":"https://github.com/advisories/GHSA-g5f9-3xfg-p9mf","publishedAt":"2026-09-24T19:17:49.000Z","cveId":"CVE-2026-61732","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["prompt_injection","jailbreak"],"issueType":"vulnerability","affectedPackages":["decepticon-sdk@<= 1.1.16 (fixed: 1.1.17)","decepticon@<= 1.1.16 (fixed: 1.1.17)","decepticon-core@<= 1.1.16 (fixed: 1.1.17)"],"affectedPackageNames":["decepticon-sdk","decepticon","decepticon-core"],"affectedPackageRefs":["pypi:decepticon-core","pypi:decepticon","pypi:decepticon-sdk"],"affectedVendors":[],"affectedVendorsRaw":["Decepticon","vLLM","SGLang","TGI","Ollama","LM Studio","text-generation-webui","OpenClaw","Qwen3.5-397B-A17B","LangChain ChatOpenAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0147,"epssCheckedAt":"2026-11-10T06:09:42.776Z","kevDateAdded":null,"advisoryAliases":["GHSA-g5f9-3xfg-p9mf"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-09-24T19:17:49.000Z","fixReleasedAt":"2026-06-24T07:49:38.504Z","daysToFix":-92,"fixCheckedAt":"2026-10-29T21:30:13.291Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality","safety"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051","AML.T0054"],"fixes":[{"ecosystem":"pypi","name":"decepticon-core","fixedVersion":"1.1.17","matchedVersion":"1.1.17","fixReleasedAt":"2026-06-24T07:49:40.078Z","daysToFix":-92,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:13.144Z"},{"ecosystem":"pypi","name":"decepticon","fixedVersion":"1.1.17","matchedVersion":"1.1.17","fixReleasedAt":"2026-06-24T07:49:38.504Z","daysToFix":-92,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:13.144Z"},{"ecosystem":"pypi","name":"decepticon-sdk","fixedVersion":"1.1.17","matchedVersion":"1.1.17","fixReleasedAt":"2026-06-24T07:49:41.244Z","daysToFix":-92,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:13.144Z"}]}}