Advisories

The task_create tool in DeepSeek TUI spawns durable sub-agents that default to allow_shell=true (config.rs:1499) and auto_approve=true (task_manager.rs:297). A user who approves a benign-looking task_create call therefore unknowingly grants the sub-agent unapproved shell access, which can follow attacker-controlled instructions in a cloned repository's AGENTS.md file and run commands without a further approval prompt. The reporter demonstrates remote code execution through a proof of concept that triggers a callback to a collaborator server.

The run_tests tool in DeepSeek TUI executes cargo test with ApprovalRequirement::Auto, so it runs without a user approval prompt. Because cargo test compiles and executes test binaries, build.rs scripts and proc macros, a malicious repository can run arbitrary shell commands with no approval, and the source states AGENTS.md can instruct the model to call run_tests at session start.

An authenticated user who can create or modify workflows can trigger global prototype pollution in n8n through an unvalidated pagination parameter in the HTTP Request node. Combined with other techniques, this can lead to RCE on the instance.

CVE-2026-44484 affects PyTorch Lightning, a deep learning framework for pretraining and finetuning AI models. The description states that versions 2.6.2 and 2.6.2 introduced functionality consistent with a credential harvesting mechanism, and GitHub, Inc. maps the weakness to CWE-506, Embedded Malicious Code, with a CVSS 4.0 base score of 9.3 (Critical).

Flowise's POST /api/v1/node-custom-function endpoint has no route-level permission middleware, so any authenticated user or API key can submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is unset, which the source describes as the common deployment case, the code runs in a NodeVM sandbox that can be escaped by abusing an Error object that crosses the sandbox boundary to recover the host Function constructor. The attacker then reaches process and child_process and runs system commands on the server host, a CVSS v3.1 score of 9.9 (Critical).

CVE-2026-42048 affects Langflow versions prior to 1.9.0 in the Knowledge Bases API (DELETE /api/v1/knowledge_bases). User-supplied knowledge base names are concatenated directly into file paths without sanitization or boundary validation. An authenticated attacker can delete arbitrary directories on the server's filesystem, causing data loss and potential service disruption.

CVE-2026-31238 affects the Ludwig framework through version 0.10.4, in its model serving component (CWE-502). When a model server starts with the ludwig serve command, the framework loads model weight files with torch.load() without setting weights_only=True, so arbitrary Python objects can be deserialized via the pickle module. An attacker who supplies a maliciously crafted PyTorch model file can achieve arbitrary code execution on the host running the Ludwig model server.

CVE-2026-43992 affects JunoClaw, an agentic AI platform built on Juno Network, prior to 0.x.y-security-1. Every MCP write tool, including send_tokens, execute_contract, instantiate_contract, upload_wasm and ibc_transfer, accepted 'mnemonic: string' as an explicit tool-call parameter. As a result, the BIP-39 seed was embedded in the LLM tool-call JSON and exposed to any transport, log or telemetry surface between the LLM provider and the MCP process.

GHSA-m77w-p5jj-xmhg reports that OpenClaude's BashTool input schema exposes `dangerouslyDisableSandbox` to the model, which the project's own threat model treats as an untrusted principal. In `shouldUseSandbox()` in `src/tools/BashTool/shouldUseSandbox.ts`, that flag skips the sandbox when `areUnsandboxedCommandsAllowed()` returns true, and that check defaults to true in `src/utils/sandbox/sandbox-adapter.ts`. A prompt-injected model can therefore set the flag in a `tool_use` block and run arbitrary host commands under default configuration.

CVE-2026-31228 affects the Adversarial Robustness Toolbox (ART) through 1.20.1, in its Kubeflow component. The robustness evaluation function for PyTorch models passes user-supplied strings for the LossFn and Optimizer parameters to eval() without sanitization, so an attacker can supply a crafted string containing arbitrary Python code. That code runs when eval() is called, giving the attacker full control of the system running the ART evaluation.

CVE-2026-31223 affects the snorkel library through v0.10.0 and is classified as CWE-502, insecure deserialization. The BaseLabeler.load() method passes user-supplied file paths to pickle.load() with no validation or security controls. A remote attacker who supplies a maliciously crafted pickle file can achieve arbitrary code execution when the file is loaded through this method.

CVE-2026-43899 affects DeepChat, an open-source AI agent platform, prior to v1.0.4-beta.1. An incomplete fix for CVE-2025-55733 left native Electron pop-up window handlers unsanitized, so a malicious Markdown link with target="_blank" can route a URL through tabPresenter.ts directly to shell.openExternal(url), bypassing the isValidExternalUrl check. A compromised AI endpoint or attacker can trigger this, enabling arbitrary protocol execution.

CVE-2026-42869 affects SOCFortress CoPilot before 0.1.57. The backend ships a hardcoded JWT signing secret as a fallback in backend/app/auth/utils.py:28 and repeats it in .env.example. Deployments that leave JWT_SECRET unset, including the default Docker Compose setup, sign every authentication token with this public value, letting an unauthenticated attacker forge admin-scoped JWTs and take full control of the application and the security tools it manages.