Advisories

Gemini CLI (`@google/gemini-cli`) and the `run-gemini-cli` GitHub Action are updated to harden workspace trust and tool allowlisting, especially in untrusted environments such as GitHub Actions. In headless mode, earlier versions automatically trusted workspace folders, so malicious environment variables in a local `.gemini/` directory could lead to remote code execution, and under `--yolo` the fine-grained tool allowlist in `~/.gemini/settings.json` was ignored. The update requires explicit folder trust and makes the policy engine evaluate tool allowlisting under `--yolo` (version `0.39.1`), which can break existing CI/CD workflows.

LiteLLM's proxy API key verification mixed the caller-supplied key value into a database query instead of passing it as a separate parameter, enabling SQL injection. An unauthenticated attacker can send a crafted Authorization header to any LLM API route, such as POST /chat/completions, and reach the query through the proxy's error-handling path. The attacker can read proxy database data and may modify it, gaining unauthorised access to the proxy and the credentials it manages.

CVE-2026-41274 affects Flowise, a drag and drop user interface for building customized large language model flows, prior to 3.1.0. The GraphCypherQAChain node passes user-provided input directly into the Cypher query execution pipeline without proper sanitization, letting an attacker inject arbitrary Cypher commands that run against the underlying Neo4j database. The flaw enables data exfiltration, modification, or deletion, and GitHub rates it CRITICAL with CVSS 4.0 base score 9.3, while NIST has not yet provided an assessment.

CVE-2026-33102 is an open redirect (CWE-601) in M365 Copilot, a hosted service. The flaw is a URL redirection to an untrusted site, which allows an unauthorized attacker to elevate privileges over a network. NVD has not yet provided an assessment; Microsoft Corporation is the source, and NVD published the entry on 04/23/2026.

A critical flaw in Pipecat's LivekitFrameSerializer, an optional, non-default, undocumented serializer deprecated in version 0.0.90, passes untrusted WebSocket message data directly to pickle.loads() in deserialize() in src/pipecat/serializers/livekit.py. A remote client that can reach a server using this serializer, for example one bound to 0.0.0.0, can send a crafted pickle payload to execute arbitrary code on the server with the Pipecat service's privileges.

CVE-2026-41276 affects Flowise versions prior to 3.1.0, a drag-and-drop interface for building customized large language model flows. Remote attackers can bypass authentication without credentials by sending a null or empty reset token to the /api/v1/account/reset-password endpoint, provided they know the victim's email address. The resetPassword method of the AccountService class fails to verify that a reset token was actually generated, letting the attacker set the user's password to any value.

CVE-2026-41268 affects Flowise, a drag-and-drop interface for building customized LLM flows, prior to 3.1.0. A parameter override bypass using the FILE-STORAGE:: keyword, combined with NODE_OPTIONS environment variable injection, lets an unauthenticated attacker run arbitrary system commands with root privileges inside the containerized Flowise instance. Exploitation needs only a single HTTP request and no prior knowledge of the instance.

CVE-2026-41265 affects Flowise versions prior to 3.1.0. The flaw sits in the run method of the Airtable_Agents class, which evaluates an LLM-generated Python script without proper sandboxing. An unauthenticated attacker who can send prompts to a chatflow using the Airtable Agent node can use prompt injection to make the LLM return a malicious script, which then runs attacker-controlled commands on the Flowise server.

CVE-2026-41138 affects Flowise, a drag and drop interface for building customized large language model flows, prior to 3.1.0. The flaw lies in AirtableAgent.ts, where user input is applied directly to the question parameter in the prompt template and passed to Python code using Pandas without sanitization, allowing remote code execution. The weakness is classified as CWE-94, Improper Control of Generation of Code.

CVE-2026-41137 affects Flowise, a drag and drop user interface for building customized large language model flows, prior to 3.1.0. The CSVAgent accepts a custom Pandas CSV read code without sanitization, so an attacker can supply a command injection payload that the server interpolates and executes. The issue is rated CRITICAL (CVSS-B 9.4, CVSS:4.0 vector with low privileges required and no user interaction), and is tracked as CWE-94.

Paperclip, a Node.js server and React UI for orchestrating AI agents, is affected by CVE-2026-41679 in versions prior to 2026.416.0. An unauthenticated attacker can achieve full remote code execution on any network-accessible instance running in `authenticated` mode with default configuration, using a six-call API chain requiring no credentials or user interaction.

CVE-2026-39987 is a pre-authorization remote code execution vulnerability in Marimo. An unauthenticated attacker can gain shell access and execute arbitrary system commands. The vulnerability is actively exploited in the wild, per CISA KEV.

Flowise versions prior to 3.1.0 contain a flaw in the MCP adapter's serialization of stdio commands. An authenticated user can add an MCP stdio server through the "Custom MCP" configuration with an arbitrary command, bypassing validateCommandInjection and validateArgsForLocalFileAccess by pairing an allowed command such as "npx" with code execution arguments like "-c touch /tmp/pwn", which achieves command execution on the underlying OS.

Trend Micro's Zero Day Initiative reports an unauthenticated remote code execution flaw in FlowiseAI Flowise, tested at version 3.0.13. The flaw sits in the run method of the CSV_Agents class, which evaluates an LLM-generated Python script without proper sandboxing. The input validation that checks for forbidden patterns can be bypassed, allowing arbitrary OS commands to run on the server as the user running it.