AI & LLM Vulnerabilities

The `NumpyReader` class in MONAI uses `np.load()` with `allow_pickle=True` (a setting that lets Python execute code hidden in data files) hardcoded, allowing attackers to run arbitrary code by distributing malicious `.npy` or `.npz` files. This vulnerability affects all MONAI versions and cannot be overridden by users, since the code explicitly prevents the `allow_pickle` parameter from being changed.

MONAI version 1.5.2 still contains a critical remote code execution (RCE) vulnerability in the `algo_from_pickle()` function, despite an earlier security advisory claiming it was patched. The vulnerable code uses `pickle.loads()` (a function that converts serialized Python objects back into code, which can execute malicious instructions) without any safety checks, allowing an attacker to run arbitrary commands if they provide a specially crafted file to the function.

CVE-2026-47629 is a vulnerability in NVIDIA Triton Inference Server for Linux that involves improper input validation (the failure to check that data entering a system is safe and correctly formatted), which could allow an attacker to cause a denial of service (making the service unavailable to legitimate users). The vulnerability has a CVSS 4.0 severity rating, though a detailed assessment is not yet available.

NVIDIA Triton Inference Server for Linux contains a vulnerability (CVE-2026-47628) that allows an attacker to allocate unlimited resources, potentially causing a denial of service (a situation where a system becomes unavailable to legitimate users). The vulnerability is classified as CWE-770, which refers to allocation of resources without limits or throttling (controls that prevent excessive resource use).

The Apify MCP server (a tool that lets AI agents scrape and extract data from websites) had a vulnerability where malicious actors could redirect connections to fake servers and steal API tokens (security credentials that grant access to accounts and data). An attacker needed to trick someone into using their malicious actor for this to work.

GeoLens had multiple authorization bypass vulnerabilities where the system only checked permission for the resource named in the URL but failed to re-check permission for a second dataset accessed through relationships or references, allowing attackers to read private dataset metadata, table rows, vector tiles (map feature data), and raster pixels (image pixel values). Some vulnerabilities required no login at all, while others only needed a default user account. All issues are fixed in version 1.2.3.

CodeWhale versions 0.8.41 through 0.8.63 have a remote code execution vulnerability (the ability for attackers to run code on your machine) in the rlm_eval tool. The tool automatically approves and runs Python code supplied by an AI model without asking the user for permission or checking their security settings, allowing attackers to inject malicious instructions into web pages or files that the AI reads and then executes on the user's computer at their privilege level.

CVE-2026-24301 is a command injection vulnerability (a weakness where an attacker hides malicious commands in user input to trick a program into executing them) in Microsoft Copilot that allows an unauthorized attacker to access and steal information over a network. The vulnerability stems from improper neutralization of special elements used in commands. The CVSS severity score (a 0-10 rating of how dangerous a vulnerability is) has not yet been assigned by NIST.

MLflow has a permission bypass vulnerability in its CreateModelVersion API. The validation functions check that a model version's source path is within a run's artifact directory, but don't verify that the caller has READ permission on that run. An authenticated user can therefore create a model version pointing to another user's private artifacts and then read those files through the model version's artifact handler, bypassing permission restrictions.