Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
The `git_blame` tool in DeepSeek-TUI has a vulnerability where it passes user input directly to a git command without validation, allowing an attacker to read arbitrary files on the system. By injecting a specially crafted argument like `--contents=/path/to/secret`, an attacker can trick the tool into displaying the contents of sensitive files (such as SSH keys or credentials) in the chat transcript, even though the tool is labeled as read-only and normally restricted to the workspace.
Fix: Users should upgrade to version 0.8.64 or later, which contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020.
GitHub Advisory DatabaseCodeWhale's js_execution tool fails to scrub sensitive environment variables (like API keys and cloud credentials) before running model-provided JavaScript code, allowing these secrets to leak back to the AI model through the tool's output. Other tools in the same codebase use an environment allowlist (child_env helper) to prevent this, but js_execution was added four days after that security fix and never implemented it.
CodeWhale's `exec_shell_interact` function has a privilege escalation vulnerability where it sends commands controlled by an AI model into an already-approved interactive shell (like Python REPL or MySQL) without requiring user approval. An attacker can use prompt injection (tricking the AI by hiding instructions in its input) to make the model send malicious commands that execute at whatever privilege level that shell has, potentially allowing root or remote command execution.
CodeWhale has a security vulnerability where a malicious `.codewhale/config.toml` file in a repository can read arbitrary files from a user's computer (like SSH keys or AWS credentials) by listing them in the `instructions` field, and then inject their contents into the AI model's system prompt (the instructions the AI receives). This happens because the code doesn't validate file paths or check if they're outside the project folder before reading them.
DocsGPT version 0.15.0 and below has a security flaw in its custom prompt feature that fails to validate user input before processing it with Jinja templates (a system for dynamically generating text). An attacker can inject malicious code into this feature to perform server-side template injection (SSTI, a technique where an attacker tricks the server into executing unintended code), potentially gaining full remote code execution (RCE, the ability to run any command on the server).
IBM Langflow OSS versions 1.0.0 through 1.10.2 contain a server-side request forgery (SSRF, a flaw that lets an attacker trick the server into making unwanted requests) vulnerability that allows an authenticated attacker, someone who has logged in, to access sensitive information.
IBM Langflow OSS (an open-source tool for building AI workflows) versions 1.0.0 through 1.10.2 has a security flaw where authenticated attackers (users with login credentials) can access sensitive information and add fake messages to workflow history because the system doesn't properly check what users are allowed to do.
IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.10.2 has a security weakness that lets an authenticated attacker (someone with login access) read sensitive information they shouldn't be able to access. The problem is that the software doesn't properly restrict which files and folders users can view, allowing them to access data outside their permitted areas.
IBM Langflow OSS versions 1.0.0 through 1.10.2 has a path traversal vulnerability (a flaw that lets attackers bypass directory restrictions to access files they shouldn't see) that allows remote attackers to view arbitrary files on a system by sending specially crafted URLs containing dot-dot sequences (/../) that move up directory levels.
IBM Langflow OSS versions 1.0.0 through 1.10.2 has a vulnerability that lets an authenticated attacker (someone with login credentials) access files they shouldn't be able to see. The attacker does this by using special URL sequences like '/../' (called path traversal, a technique where attackers navigate to parent directories to escape restricted folders) to trick the system into showing arbitrary files stored on the server.
In IBM MQ Agent CD versions 1.0.0, 1.0.1, 2.0.0, and 2.0.1, a logged-in user can send extremely large or computationally expensive requests that tie up the LLM agent workers (the programs handling AI tasks) for very long periods, sometimes over ten minutes each. When many such requests are sent at once, all the available workers become blocked, making the AI Agent feature slow or completely unavailable for other users.
IBM Langflow OSS versions 1.0.0 through 1.11.2 have a vulnerability where authenticated attackers (users with login access) can read any file on the server by tricking the system into treating file paths as input, exposing sensitive data like secret keys (cryptographic material used to secure the system) and databases. The vulnerability bypassed a security setting meant to prevent local file access, specifically in the component that handles chat message attachments sent to language models.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.11.2 has a vulnerability that lets remote attackers (people accessing the system from outside) steal sensitive information through SSRF (server-side request forgery, where an attacker tricks the server into making requests it shouldn't, potentially accessing internal data).
IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.11.2 has a vulnerability where a logged-in attacker could exploit a URL parser discrepancy (a difference in how URLs are interpreted) to access sensitive information from internal services.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.11.2 has a vulnerability where an authenticated attacker (someone with valid login credentials) can delete any files or folders on the server because the software doesn't properly restrict which directories users can access. This happens because the application fails to limit file paths (the addresses of files on disk) to only safe, intended locations.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.11.2 has a security flaw where a logged-in attacker could access sensitive information by exploiting improper validation of symbolic links (shortcuts to files that can trick a system into reading files it shouldn't).
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.11.2 has a vulnerability that allows an authenticated attacker (someone with login access) to steal sensitive information through SSRF (server-side request forgery, where an attacker tricks the server into making requests to internal systems the attacker shouldn't access).
IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.11.2 has a vulnerability where sensitive information like credentials is not properly hidden or removed from data. This allows remote attackers (people accessing the system over the internet) to see this sensitive information they shouldn't be able to access.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.11.2 has a vulnerability where an authenticated attacker (someone with login credentials) can exploit path traversal (a technique that tricks the software into accessing files outside intended directories) to steal sensitive information.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.11.2 has a security flaw where an authenticated attacker (someone with login credentials) could run arbitrary code (any commands they want) by bypassing authorization checks (security rules that prevent unauthorized actions) in the flow build process (the system that constructs automated workflows).
Fix: Users should upgrade to version 0.8.64 or later. The fix is contained in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e, which adds the missing child_env scrubber to js_execution.
GitHub Advisory DatabaseFix: Users should upgrade to version 0.8.64 or later, which contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381.
GitHub Advisory DatabaseFix: Users should upgrade to version 0.8.64 or later, which contains the fix in commit 43563356b98c6b993085554da82e77370160a31c.
GitHub Advisory Database