Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
vLLM before 0.31.0 has a cross-request mask leak in InputBatch.condense(). Remote attackers can leave stale allowed_token_ids rows, so recycled batch slots apply their token allowlist to other clients' unrestricted requests, constraining their outputs.
CVE-2026-112380 is an authorization flaw in the WhatsApp channel and the internal subagent run-control endpoints of Kiro Crew, affecting versions >=0.4.0 and <0.7.2. In configurations where a WhatsApp group was added to allowed groups or the direct-message policy was set to open, a group member could send instructions to another session's subagent, which executed them on the operator's machine, with the audit trail attributed to the operator. The default configuration is not affected.
The MCP TypeScript SDK (`@modelcontextprotocol/sdk` 1.3.0 through 1.31.0, and `@modelcontextprotocol/server` 2.0.0 through 2.2.0) placed no limit on the number of array elements and object keys it validated per request. A single HTTP request within the default 4 MiB size limit can exhaust server memory and abort the process with `JavaScript heap out of memory`. No credentials are needed unless requests are authenticated before reaching the SDK, and stdio-only servers are not affected.
Upgrade to `@modelcontextprotocol/sdk` 1.32.0 or later, or `@modelcontextprotocol/server` 2.3.0 or later, then set the new `maxToolInputElements` option on `McpServer` (off by default), for example `new McpServer(info, { maxToolInputElements: 10_000 })`. Also lower the request size limit with `maxRequestBodySize` on the transport or `createMcpHandler()`, or the body parser's limit if the body is parsed manually. If upgrading is not possible yet, set `maxRequestBodySize`, which requires `@modelcontextprotocol/sdk` 1.30.1 or `@modelcontextprotocol/server` 2.1.0, or use a reverse proxy.
Affected versions of the MCP TypeScript SDK (@modelcontextprotocol/sdk 1.24.0 through 1.31.0) did not check which session created an experimental task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Only servers that pass taskStore to McpServer or Server are affected.
Fix: Upgrade to @modelcontextprotocol/sdk 1.32.0 or later. If you cannot upgrade yet, remove taskStore, or create one InMemoryTaskStore per session.
Affected versions of the MCP TypeScript SDK, including @modelcontextprotocol/sdk through 1.31.0 and @modelcontextprotocol/client 2.0.0 through 2.2.0, followed HTTP redirects to any origin in StreamableHTTPClientTransport, SSEClientTransport and the OAuth client functions such as auth(). A cross-origin redirect sent custom headers such as X-API-Key and the mcp-session-id header to the new origin, and on a 307 or 308 response it also sent the request body, including OAuth refresh_token and client_secret values. stdio clients are not affected.
In TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page so the editor plugin can call the OpenAI service directly from the browser. Any authenticated backend user can read the key and spend the site operator's quota. The issue only applies when an API key has been configured.
Aix-DB 1.2.4 contains CVE-2026-77926, a remote code execution flaw. Authenticated non-admin users can run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Crafted chat input sent to POST /dify/get_answer, or documents uploaded with malicious text, can run host commands and expose datasource credentials and model API keys.
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. A remote attacker can send one request naming the shell tool to run arbitrary OS commands as the server user, which is root in the shipped Docker image.
JoySafeter through 1.0.0 contains a remote code execution flaw in its unsandboxed execute tool, reachable in Copilot standard mode. An authenticated user can self-register, select standard mode through the WebSocket chat.start extension, and have the agent call subprocess.run with shell=True on the host, which exposes other tenants' data and server secrets.
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability. Remote attackers can plant instructions in web content the agent retrieves, causing it to run shell commands or Python. Because Bash and ExecuteCode have no allow-list or human-in-the-loop approval, the attacker can execute code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain three message endpoints that do not verify ownership. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or take over an entire conversation session by reassigning its session ID.
MLflow 3.17.1 and earlier contains a path traversal flaw in the FileStore tracking backend. An unauthenticated attacker can submit a crafted trace ID with traversal sequences to POST /api/3.0/mlflow/traces, causing FileStore.start_trace() to write trace_info.yaml, request_metadata and tag files outside the intended experiment trace directory, limited by the server process's filesystem permissions. FileStore is the default backend before MLflow 3.7.0 and opt-in afterward, so earlier deployments are exposed by default while later ones are exposed only when FileStore is explicitly selected.
Mercury's mr.Markdown widget converts input with python-markdown and no sanitization, and MarkdownWidget writes the result to the DOM via innerHTML without sanitization. When an app passes untrusted data to mr.Markdown, HTML or JavaScript in that data executes in the browser of whoever views the app, a stored or DOM-based XSS.
The Envoy AI Gateway MCP proxy's session-resume path never checks the subject (JWT `sub` claim) embedded in the client-facing session ID, so any client holding a session ID can resume another user's session and invoke backend methods such as `tools/call` and `resources/read`. The official Helm chart aggravates this by defaulting the session encryption seed to the publicly known `"default-insecure-seed"`, which would let an attacker forge session IDs.
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool. The tool never applies the validate_url private-address check, so attackers can make it fetch internal resources. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.
BentoML through 1.4.39 contains a Dockerfile instruction injection flaw in the legacy base.j2 template, which renders docker.env mapping keys without stripping newlines. An attacker who supplies a crafted bentofile.yaml or imported bento archive can get bentoml containerize to run injected RUN instructions during docker build, exposing build secrets and enabling image poisoning.
A vulnerability in ESPnet up to 202610.post2 affects the build_model function in espnet3/publication/inference_model.py, part of the Inference Model Handler component. Manipulating the _target_ argument leads to deserialization, and the attack can be launched remotely. A public exploit exists.
Fix: The patch is identified as f217b24f06de55e332cab10231469d5890dbbe00. It is best practice to apply a patch to resolve this issue.
CVE-2026-112081 affects hankcs HanLP up to 2.1.0-beta.64, specifically the function hanlp.load in plugins/hanlp_common/hanlp_common/reflection.py within the Model Config Loading component. Manipulation of the classpath argument causes deserialization and can be triggered remotely. The exploit has been publicly disclosed, and the project was informed through an issue report but has not yet responded.
A security vulnerability in WongKinYiu yolov9 0.1 affects the DetectMultiBackend.__init__ function in models/common.py, within the ONNX Metadata Handler component. Manipulating the names/stride argument leads to code injection, and the attack can be exploited remotely. The exploit is publicly disclosed, and the project was notified through an issue report but has not yet responded.
Fix: Upgrade @modelcontextprotocol/sdk to 1.32.0 or later, or @modelcontextprotocol/client to 2.3.0 or later. Redirects are now followed only within the same origin, and not at all in browsers. If a redirect may have reached a host you do not control, rotate the API keys and client_secret and revoke tokens. If you cannot upgrade yet, pass a fetch that refuses redirects, for example (url, init) => fetch(url, { ...init, redirect: 'error' }).