Advisories

Xinference used Python's eval() to parse Llama3 tool-call output in the extract_tool_calls() function of xinference/model/llm/tool_parsers/llama3_tool_parser.py. A remote, unauthenticated attacker can use prompts sent to the /v1/chat/completions endpoint to make the model return a Python expression, which the server evaluates. The flaw is rated Critical, CVSS 10.0, and allows remote code execution in the Xinference server process in the tested default deployment.

CVE-2026-62674 affects Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0. The PUT /sessions/{session_id}/agent endpoint checks LEVEL_EDIT permission but does not reject a bound shared or template agent whose agent.session_id is None. An authenticated user with edit access to a session can replace that shared agent bundle, add a stdio MCP server, and cause later sessions using the shared agent to run an attacker-controlled command with the Omnigent runner's permissions, exposing files, credentials, workspace data, internal services, and runner availability.

CVE-2026-47627 affects NVIDIA Triton Inference Server for Linux and is classified as CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The source states that an attacker could cause path traversal, and a successful exploit might lead to denial of service. NVD had not yet provided an assessment when the entry was published on 08/18/2026.

Context7 through version 2.1.2 contains a prompt injection flaw in its Custom AI Instructions feature, served through the MCP server. An attacker can inject unsanitized content into those instructions, which connected AI coding agents then execute. The poisoned instructions can exfiltrate credentials from environment files to an attacker-controlled service and delete files on the victim's machine when the agent makes a routine library documentation request.

CodeWhale (codewhale and codewhale-tui) versions 0.8.41 up to but not including 0.8.64 contain an argument injection flaw in the git_show tool. The model-supplied rev parameter reaches the git show argv without an --end-of-options sentinel, so a value starting with --output= is read as a git flag, enabling arbitrary file writes as the invoking user, since the tool is auto-approved and advertised as read-only.

The unauthenticated webhook test endpoint in the default MLflow Tracking Server (`POST /api/2.0/mlflow/webhooks/{id}/test`) returns the upstream response status and body to the caller. The SSRF guard `_validate_webhook_url`, added in PR #20747 and shipped in 3.10.0, checks only the original hostname, and delivery follows HTTP redirects without re-validation or IP pinning, so an allow-listed HTTPS host can redirect to internal or metadata addresses and the response is reflected back, yielding unauthenticated full-read SSRF on a default server.

MemOS, a memory operating system for LLMs and AI agents, has an authentication bypass when AUTH_ENABLED=true but the INTERNAL_SERVICE_SECRET environment variable is unset. The is_internal_request() check in src/memos/api/middleware/auth.py then compares None to None, which evaluates true, so an unauthenticated remote attacker is treated as an internal principal with scopes ["all"]. This grants access to admin API-key management endpoints (minting, enumerating, revoking keys, and generating a master key) and to all data endpoints.

CVE-2026-64859 affects New API, a large language model (LLM) gateway and asset management system, prior to 1.0.0-rc.7. The admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token, so an authenticated administrator can obtain the root user's bearer token and access root-only system configuration APIs. The weakness is classified as CWE-200.

UpTrain versions 0.7.1 and prior are affected by a remote code execution flaw in the /new_run endpoint, reachable through the checks and metadata parameters. Any user with access to UpTrain and a valid authentication method may be able to run arbitrary code in the context of the host, which in most cases is the docker container suggested by the documentation.

UpTrain versions 0.7.1 and prior have a remote code execution flaw in the `/add_prompts` endpoint, reachable through the `checks` and `metadata` parameters. Any user with UpTrain access and a valid authentication method may execute arbitrary code in the context of the host running UpTrain, which in most cases is the Docker container suggested by the documentation.

UpTrain versions 0.7.1 and prior expose a remote code execution flaw in the /create_project endpoint, reachable through the checks and metadata parameters. Any user with access to UpTrain and a valid authentication method may run arbitrary code in the context of the host running UpTrain, which in most cases is the Docker container suggested by the documentation.