Advisories

Mistral Vibe before 2.25.5 contains a remote code execution flaw in its worktree creation process, which runs git hooks before trust validation. An attacker who supplies a repository with a crafted post-checkout hook can execute arbitrary shell commands with the privileges of the user running Vibe.

A containerized MCP server running under the default `network` permission profile (`insecure_allow_all: true`) can reach host-local services through `host.docker.internal`, including the ToolHive API, other ToolHive-managed MCP server proxies, and other localhost services. Because the ToolHive API and MCP proxy endpoints are unauthenticated, a compromised or malicious MCP server can move laterally without a container escape. The source rates the severity High.

LMDeploy, through its latest release, passes the quant_dtype value from a model's HuggingFace quantization_config directly into eval(f'torch.{quant_dtype}') at lmdeploy/pytorch/config.py line 620 with no validation. The AWQ branch does not override this value, so a malicious model can run arbitrary Python when loaded with lmdeploy. The advisory describes this as a supply-chain vector affecting any user who loads an untrusted model.

vLLM versions before 0.28.0 do not validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints. An unauthenticated attacker can crash the engine by submitting a negative token ID, which triggers a CUDA device-side assertion that poisons the GPU context and makes all later requests fail until the process restarts.

CVE-2026-85887 is an incorrect permission assignment for a critical resource in M365 Copilot. An authorized attacker can exploit it over a network to disclose information.

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0 to exhaust decode-worker memory without bound until the worker restarts.

CVE-2026-78501 is an improper neutralization of special elements used in a command ('command injection') flaw in Microsoft 365 Copilot's Business Chat. An unauthorized attacker can exploit it over a network to disclose information.

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network. The source gives no affected versions, attack preconditions or further technical detail.

AI Agent Automation, a modular AI agent workflow platform, is affected by CVE-2026-54520 in versions prior to 0.9.1. The executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd() and uses the result for reads or writes without confirming it stays inside an approved workflow directory. An authenticated user who can create or modify workflow file steps can use traversal segments to read sensitive files or write and overwrite files the backend process can access, including application-adjacent files when process permissions allow.

AI Agent Automation versions prior to 0.9.1 contain an authorization flaw in backend/src/controllers/memory.controller.js. The listMemories, deleteMemory, and clearAgentMemory functions accept a caller-supplied agentId or memory _id without checking that the related Agent belongs to req.user. An authenticated attacker who knows or obtains another user's identifiers can read that user's AgentMemory content, delete an individual memory, or clear all memory for a victim agent.

SQLBot, a Text-to-SQL system built on large language models and RAG, is affected by CVE-2026-53556 before version 1.9.0. The POST /api/v1/datasource/previewData endpoint places the client-controlled table_name value into generated SQL without safe identifier handling. An authenticated user can use a crafted table_name to call pg_read_file(), pg_read_binary_file() or pg_ls_dir() through a datasource pointed at the internal PostgreSQL service, reading filesystem content such as /etc/hosts and /etc/passwd, and potentially configuration, credentials and source code. In the default tested trusted loopback authentication configuration, the connection runs with PostgreSQL superuser privileges.

CVE-2026-53554 affects SQLBot, a Text-to-SQL system built on large language models and RAG, prior to 1.9.0. The POST /api/v1/datasource/parseExcel endpoint trusts attacker-controlled multipart filenames when choosing storage, and it writes uploaded content before spreadsheet parsing and validation finish. A crafted upload can plant a Python file in /opt/sqlbot/app/alembic/versions/ even when parsing fails and the endpoint returns an error. On the next startup or migration, Alembic imports that file and runs its module-level statements inside the SQLBot runtime.

MCP Documentation Server versions 1.13.0 through 1.13.1 start a Web UI by default on port 3080, and startWebServer in src/web-server.ts calls app.listen(PORT) without a host, binding the unauthenticated document-management API to all interfaces instead of localhost. A network-reachable client can call endpoints such as GET /api/documents, POST /api/documents, DELETE /api/documents/:id and POST /api/search-all without credentials to read, search, insert or delete documents and alter the assistant's knowledge base. The attacker must be able to reach the service over a LAN, VM network, container bridge, VPN or other routed network, and the issue does not grant remote code execution.