Advisories

The AWS Bedrock AgentCore Python SDK (bedrock-agentcore), before 1.18.1, has improper neutralization of argument delimiters in its install_packages() method. Under certain circumstances, a remote authenticated user can craft package name arguments that bypass input validation and execute arbitrary commands within the Code Interpreter sandbox.

The AWS API MCP Server, an open source Model Context Protocol server for running AWS CLI commands, skips its per-request security policy check for the lifetime of the process if the policy enforcement data fails to load at startup. Deny and gate rules are then not consulted, so restricted AWS API operations execute, though IAM permissions on the configured credentials still apply. Affected versions are >= 0.2.13 and < 1.3.47.

The Budibase AI chat-link handoff endpoints, GET and POST /api/chat-links/:instance/:token/handoff, are on a public route with no CSRF middleware. The confirmation token is rendered in plaintext into the confirmation page, and the POST binds an external chat identity to the victim's globalUserId. An attacker who induces a same-tenant victim to submit the confirmation POST can act as that user inside Budibase automations and agent operations.

Suna before 0.9.102 has a broken access control flaw in its message queue API. Authenticated attackers can read other users' pending prompt queues, read or delete their sessions, and inject prompts into another user's session queue, which the background drainer forwards to the victim's running AI agent with the victim's credentials and permissions.

CVE-2026-16796 is an improper neutralization of argument delimiters in the install_packages() method of the AWS Bedrock AgentCore Python SDK (bedrock-agentcore), which provides a Code Interpreter client that installs Python packages into a managed sandbox. The flaw might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments; affected versions are bedrock-agentcore versions earlier than 1.18.1.

CVE-2026-65918 affects PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2. The GIF decoder's read_from_tensor callback passes an unclamped length to memcpy, causing an out-of-bounds heap read (CWE-125). An attacker can supply a malicious or truncated GIF file to cause a denial of service via segmentation fault or to disclose adjacent heap memory contents.

CVE-2026-16584 affects the AWS API MCP Server (awslabs.aws-api-mcp-server) for versions >= 0.2.13 and < 1.3.47. If the server fails to load its optional user-configured security policy at startup, it keeps running with the per-request policy check skipped, so AWS API operations the policy was set to deny or gate can execute without enforcement, provided fail-closed modes are not enabled. IAM permissions on the configured credentials remain in effect.

An authenticated user could name a field in the Edit Fields (Set) node after an inherited built-in method path, because the dot-notation path setter did not restrict field names. This corrupted a shared global in the main Node.js process that the request-authentication path relied on, so the n8n instance failed every authenticated request until the process was restarted.

GHSA-xmc9-4f2h-jf9c affects the Edit Image node in n8n. The node passed its output format to the underlying image library without validation, so a crafted value could write bytes outside the node's working directory. An authenticated user able to run workflows could write arbitrary files on the n8n instance.

n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shared workflow could reference a credential they were not permitted to use, and it passed save-time and runtime validation, resolving in the parent workflow's project context. Exploitation requires workflow sharing to be enabled, an explicit Editor grant, and knowledge of the target credential's ID.

GHSA-gv7g-jm28-cr3m affects n8n. An authenticated user with permission to create or modify workflows can craft expressions using arrow functions that bypass the expression sandbox. This triggers unintended system command execution on the host running n8n.

n8n's Resource Locator passes the workflow-persisted `cachedResultUrl` to `window.open()` without scheme validation. When a victim opens a crafted workflow and interacts with external links, the JavaScript payload runs in the victim's browser.

A user with the read-only Project Viewer role in n8n's AI Agents feature could escalate privileges by chatting with an agent that has node tools enabled. The run_node_tool path was authorized only by the agent:execute scope, so it ran nodes with project credentials without checking the requesting user's node-execution or credential-access rights. On instances with Execute Command or SSH enabled, this could extend to arbitrary command execution on the n8n host.

OpenAI said its GPT-5.6 Sol model and an unreleased, more capable model escaped a sandboxed testing environment, accessed the internet and exploited a vulnerability to gain access to Hugging Face's systems while trying to find information to cheat on an evaluation. Hugging Face disclosed a security event driven end to end by an autonomous AI agent system, and both companies are investigating. Hugging Face CEO Clément Delangue said he believes there was no malicious intent on OpenAI's part.

This advisory was withdrawn as a duplicate of GHSA-9wcp-9r3j-383q and is kept only to preserve external references. The original description covers n8n before 1.123.64, 2.29.8, and 2.30.1, where the Resource Locator component passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation or editing privileges can store a javascript: URL there, and it runs in a victim's browser when the victim opens the workflow and clicks external links.