What changed in AI security, May 13 to May 19, 2024
May 13 to May 19, 2024 (ISO week 2024-W20). Weeks run Monday to Sunday in UTC.
10 records published, +8 on the previous week: 9 vulnerabilities (+7), 0 incidents (no change), 0 research items (no change), 1 news item (+1), 0 policy items (no change).
Critical and high advisories
Vulnerability records rated critical or high, newest first.- High
GHSA-7ggm-4rjg-594w: litellm passes untrusted data to `eval` function without sanitization
CVE-2024-4264GitHub Advisory Database - High
CVE-2024-3848: mlflow/mlflow path traversal in artifact URL handling via fragment
CVE-2024-3848NVD/CVE Database - Critical
CVE-2024-4181: llama_index RunGptLLM command injection via eval in LLM provider responses
CVE-2024-4181NVD/CVE Database - Critical
CVE-2024-34440: AI Engine: ChatGPT Chatbot unrestricted upload of dangerous file types
CVE-2024-34440NVD/CVE Database - Critical
CVE-2024-0087: NVIDIA Triton Inference Server for Linux arbitrary file logging location
CVE-2024-0087NVD/CVE Database - Critical
CVE-2024-34359: llama-cpp-python remote code execution via chat template in GGUF metadata
CVE-2024-34359NVD/CVE Database
Exploitation signals
Vulnerabilities published in the week that are listed in the CISA Known Exploited Vulnerabilities catalog or have an EPSS score of 10% or more.| Advisory | Exploitation | EPSS | Published |
|---|---|---|---|
| CVE-2024-3848: mlflow/mlflow path traversal in artifact URL handling via fragment CVE-2024-3848NVD/CVE Database | Not listed | 43.3% | |
| CVE-2024-34359: llama-cpp-python remote code execution via chat template in GGUF metadata CVE-2024-34359NVD/CVE Database | Not listed | 26.0% | |
| CVE-2024-0087: NVIDIA Triton Inference Server for Linux arbitrary file logging location CVE-2024-0087NVD/CVE Database | Not listed | 19.9% | |
| CVE-2024-0088: NVIDIA Triton Inference Server for Linux memory access flaw CVE-2024-0088NVD/CVE Database | Not listed | 18.9% |
Packages that began delegating to a language model
Exposure Registry packages whose first release declaring an LLM SDK, agent framework or MCP dependency was published in the week.| Package | Ecosystem | LLM SDKs | Release | Released |
|---|---|---|---|---|
| optimum-benchmark | PyPI | Hugging Face Hub / Transformers, llama.cpp bindings | 0.2.0 | |
| langchain-huggingface | PyPI | LangChain | 0.0.1 | |
| pipecat-ai | PyPI | Anthropic SDK, Google Gemini SDK, Groq SDK, Hugging Face Hub / Transformers, LangChain, Model Context Protocol SDK, Mistral AI SDK, OpenAI SDK, Strands Agents | 0.0.9 |
Topics that moved
Largest increases over the mean of the 4 previous weeks, for topics with at least 3 records in the week.| Topic | Records | Weekly mean, previous 4 | Difference |
|---|---|---|---|
| Inference infrastructure | 4 | 0.0 | +4.0 |
Research
Peer-reviewed first, then newest.No research papers or reports were published in this week.
Policy and regulation
Newest first.No regulatory or policy records were published in this week.
Generated from the AI Sec Watch database at . Every item links to its record.