Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
51 items
CVE-2024-9070 is a deserialization flaw in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1, classified as CWE-502. Setting the args-number parameter greater than 1 triggers automatic deserialization. An attacker can use this to execute unauthorized arbitrary code on the server.
CVE-2024-9053 affects vllm-project vllm version 0.6.0. In the AsyncEngineRPCServer() RPC server entrypoints, run_server_loop() calls _make_handler_coro(), which passes received messages directly to cloudpickle.loads() without sanitization. The source states this can result in remote code execution by deserializing malicious pickle data.
CVE-2024-7776 affects the `download_model` function in the onnx/onnx framework, before and including version 1.16.1. Path traversal is not adequately prevented when processing malicious tar files, allowing arbitrary file overwrite in the user's directory. The source states this could potentially lead to remote command execution.
CVE-2024-11041 affects vllm-project vllm version v0.6.2. The MessageQueue.dequeue() API function passes received socket data directly to pickle.loads, which allows remote code execution. An attacker who sends a malicious payload to the MessageQueue can make the victim's machine run arbitrary code.
CVE-2024-10950 affects the `CodeInterpreter` plugin in binary-husky/gpt_academic, versions <= 3.83. The plugin executes user-provided prompts that generate untrusted code without a sandbox, so prompt injection can cause code injection. An attacker can exploit this for remote code execution on the application backend server, potentially gaining full control of the server.
CVE-2025-27781 affects Applio, a voice conversion tool, in versions 3.2.8-bugfix and prior. User-supplied input for `model_file` in inference.py and tts.py flows through `change_choices` and `get_speakers_id` into `torch.load` at line 326 of inference.py (3.2.8-bugfix), enabling unsafe deserialization that can lead to remote code execution.
Fix: A patch is available on the `main` branch of the repository.
CVE-2025-27780 affects Applio, a voice conversion tool, in versions 3.2.8-bugfix and prior. User-supplied input for `model_name` in model_information.py is passed through `run_model_information_script` to the `model_information` function, which loads the model with `torch.load` at rvc/train/process/model_information.py (line 16 in 3.2.8-bugfix). Because this call is unsafe, the flaw can lead to remote code execution.
Fix: A patch is available in the `main` branch of the repository.
Applio versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `model_blender.py` on lines 20 and 21. The `model_fusion_a` and `model_fusion_b` inputs from `voice_blender.py`, which can be a user-supplied model path, reach `torch.load` without safe handling, and the issue can lead to remote code execution.
Fix: A patch is available on the `main` branch of the Applio repository.
NVD/CVE DatabaseCVE-2025-29783 affects vLLM when it is configured to use Mooncake. Unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces lets attackers execute remote code on distributed hosts. The flaw impacts any deployment that uses Mooncake to distribute KV across distributed hosts.
Fix: Fixed in 0.8.0.
NVD/CVE DatabaseCVE-2025-1473 is a Cross-Site Request Forgery (CSRF) flaw in the Signup feature of mlflow/mlflow versions 2.17.0 through 2.20.1. An attacker can use it to create a new account, which the malicious user can then use to perform unauthorized actions.
Fix: The source text lists a patch reference at https://github.com/mlflow/mlflow/commit/ecfa61cb43d3303589f3b5834fd95991c9706628 but does not state a fixed version or configuration change.
CVE-2025-0453 affects mlflow/mlflow version 2.17.2. The `/graphql` endpoint is vulnerable to denial of service, because an attacker can send large batches of queries that repeatedly request all runs from a given experiment. This ties up all the workers MLFlow allocates and leaves the application unable to respond to other requests.
CVE-2025-0317 affects ollama/ollama versions <=0.3.14. A malicious user who can upload and create a customized GGUF model file on the Ollama server can trigger a division by zero error in the ggufPadding function. The server then crashes, resulting in a Denial of Service (DoS) attack. The weakness is classified as CWE-369 (Divide By Zero).
CVE-2025-0315 affects ollama/ollama versions up to and including 0.3.14. A malicious user can craft a customized GGUF model file, upload it to the Ollama server, and create it, causing the server to allocate unlimited memory. The result is a Denial of Service (DoS) condition, classified under CWE-770 (Allocation of Resources Without Limits or Throttling).
CVE-2025-0312 affects ollama/ollama versions <=0.3.14. A malicious user can craft a customized GGUF model file that, when uploaded and created on the Ollama server, triggers an unchecked null pointer dereference (CWE-476). The crash enables a Denial of Service attack over the remote network.
CVE-2024-8966 affects the file upload process of gradio-app/gradio, specifically @gradio/video@0.10.2. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue warnings. This can make Gradio inaccessible for extended periods, causing downtime. NVD has not yet provided an assessment.
CVE-2024-8859 is a path traversal flaw in mlflow/mlflow version 2.15.1. When the dbfs service is configured and mounted to a local directory, concatenating the URL directly into the file protocol enables arbitrary file read, because only the URL's path part is checked while query and parameters are not handled. The issue is tracked as CWE-29 and was published to NVD on 03/20/2025.
Fix: Patch: https://github.com/mlflow/mlflow/commit/7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654
CVE-2024-8063 is a divide by zero flaw (CWE-369) in ollama/ollama version v0.3.3. It is triggered when GGUF models are imported with a crafted type for `block_count` in the Modelfile. The server crashes when it processes such a model, causing a denial of service (DoS).
CVE-2024-7959 affects the `/openai/models` endpoint in open-webui/open-webui version 0.3.8. The endpoint is vulnerable to Server-Side Request Forgery (SSRF) because an attacker can change the OpenAI URL to any URL without checks, causing the endpoint to send a request there and return the output. This allows access to internal services and potentially command execution by reading instance secrets.
CVE-2024-12720 is a Regular Expression Denial of Service (ReDoS) flaw in the huggingface/transformers library, in tokenization_nougat_fast.py. A regex in the post_process_single() function processes specially crafted input, and exponential backtracking drives up CPU usage and can cause application downtime. The affected version is v4.46.3 (latest).
CVE-2024-12217 affects the gradio-app/gradio repository at version git 67e4044 on Windows. The blocked_path check, meant to stop users from reading certain files, fails when a path uses NTFS Alternate Data Streams syntax, such as 'C:/tmp/secret.txt::$DATA', even though the plain path is blocked. This flaw allows unauthorized reading of blocked file paths.