Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
GPT-SoVITS-WebUI (a tool for converting voices and creating speech from text) has a vulnerability in versions 20250228v3 and earlier where user input for model file paths is passed unsafely to torch.load, a function that reads model files. This unsafe deserialization (loading files without proper security checks) could allow attackers to execute malicious code by providing a specially crafted model file.
GPT-SoVITS-WebUI, a tool for converting voices and generating speech from text, has an unsafe deserialization vulnerability (a flaw where untrusted data is converted back into code objects, potentially allowing attackers to run malicious code) in versions 20250228v3 and earlier. The vulnerability occurs because user-supplied file paths are directly passed to torch.load, a function that can execute arbitrary code during the deserialization process.
DSpace, an open-source application for storing and accessing digital files, has a vulnerability in versions before 7.6.4, 8.2, and 9.1 where it doesn't properly disable XML External Entity (XXE) injection, a technique where attackers embed malicious code in XML files to read sensitive files or steal data from the server). The vulnerability affects both the command-line import tool and the web interface's batch import feature, but only administrators can trigger it by importing archive files.
A ReDoS (regular expression denial of service, where carefully designed text input causes a regex pattern to consume excessive CPU) vulnerability was found in the Hugging Face Transformers library's DonutProcessor class, affecting versions 4.50.3 and earlier. The vulnerable regex pattern can be exploited through crafted input strings to cause the system to slow down or crash, disrupting document processing tasks that use the Donut model.
A WordPress plugin called 'Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery' has a vulnerability called Stored Cross-Site Scripting (XSS, where an attacker can hide malicious code in a webpage that runs when others view it) in versions up to 26.0.8. Attackers with Author-level permissions or higher can inject harmful scripts through the upload title field because the plugin doesn't properly clean and secure user input.
CVE-2025-7021 is a vulnerability in OpenAI Operator SaaS on Web where an attacker can trick users into entering sensitive information like login credentials by creating a fake fullscreen interface that mimics browser controls and hides security warnings. The attacker overlays distracting elements (such as a fake cookie consent screen) to obscure notifications and deceive users into interacting with the malicious site. This vulnerability has a CVSS score of 6.9 (MEDIUM severity).
Roo Code is an AI tool that can write code automatically. Before version 3.22.6, if a user had auto-approved write permissions, an attacker could send prompts to the agent that would modify VS Code settings files (configuration files that control how the editor works) and run malicious code on the user's computer. For example, an attacker could change a PHP validation setting to point to a harmful command, then create a PHP file to execute it.
Hugging Face Transformers versions up to 4.49.0 have a vulnerability in the `image_utils.py` file where URL validation (checking if a URL starts with certain text) can be tricked through URL username injection (adding fake credentials to a URL). Attackers can create fake URLs that look like they're from YouTube but actually point to malicious sites, risking phishing attacks, malware, or stolen data.
A ReDoS vulnerability (regular expression denial of service, where specially crafted text causes a regex pattern to consume excessive CPU) was found in Hugging Face Transformers library version 4.49.0, specifically in code that filters Python try/except blocks. Attackers could exploit this to crash or slow down systems using the library, potentially disrupting model serving or supply chain processes.
A ReDoS vulnerability (regular expression denial of service, where specially crafted input causes a program to use excessive CPU by making the regex engine work inefficiently) was found in the Hugging Face Transformers library version 4.49.0, specifically in a function that reads configuration files. An attacker could send malicious input to make the application slow down or crash by exhausting its computing resources.
A ReDoS vulnerability (regular expression denial of service, where inefficient pattern matching causes a system to slow down or crash) was found in the Hugging Face Transformers library version 4.49.0. The problem is in a regex pattern called `SETTING_RE` that uses inefficient repetition, causing it to take exponentially longer when processing specially crafted input strings, which can make the application unresponsive or crash.
BerriAI litellm version 1.65.4 contains a SQL injection vulnerability (a type of attack where malicious SQL code is inserted into user inputs to manipulate database queries) in the /key/block endpoint. This weakness allows attackers to potentially access or modify database contents through this vulnerable endpoint.
A vulnerability exists in Anthropic's deprecated Slack MCP Server (Model Context Protocol Server, a tool that lets AI agents interact with Slack) that allows attackers to steal sensitive data. When an AI agent processes untrusted input, an attacker can trick it into creating messages with malicious links that, when Slack's link preview bots automatically expand them, secretly send private data to the attacker's server without requiring any user action.
The @cyanheads/git-mcp-server (an MCP server, or a tool that lets AI systems interact with Git repositories) has a command injection vulnerability (a flaw where attackers can sneak extra system commands into input) in versions before 2.1.5. Because the server doesn't check user input before running system commands, attackers can execute arbitrary code on the server, or trick an AI client into running unwanted actions through indirect prompt injection (hiding malicious instructions in data the AI reads).
CVE-2025-6855 is a critical vulnerability in Langchain-Chatchat (a tool built on LLMs) up to version 0.3.1 that allows path traversal (accessing files outside the intended directory) through manipulation of a parameter called 'flag' in the /v1/file endpoint. The vulnerability has been publicly disclosed and could potentially be exploited.
CVE-2025-6854 is a path traversal vulnerability (a flaw that lets attackers access files outside intended directories) in Langchain-Chatchat software versions up to 0.3.1, specifically in a file upload endpoint. The vulnerability can be exploited remotely by attackers with login credentials and has already been publicly disclosed.
CVE-2025-6853 is a critical vulnerability in Langchain-Chatchat version 0.3.1 and earlier that allows attackers to exploit a path traversal (a type of attack where an attacker manipulates file paths to access files outside their intended directory) flaw in the upload_temp_docs backend function by manipulating the flag argument. The vulnerability can be exploited remotely by users with basic access permissions, and the exploit details have been publicly disclosed.
Roo Code is an AI tool that can automatically write code, and it stores settings in a `.roo/mcp.json` file that can execute commands. Before version 3.20.3, an attacker who could trick the AI (through prompt injection, a technique where hidden instructions are embedded in user input) into writing malicious commands to this file could run arbitrary code if the user had enabled automatic approval of file changes. This required multiple conditions: the attacker could submit prompts to the agent, the MCP (model context protocol, a system for connecting AI agents to external tools) feature was enabled, and auto-approval of writes was turned on.
Roo Code, an AI agent that writes code automatically, had a vulnerability (CVE-2025-53097) in versions before 3.20.3 where its file search tool ignored settings that should have blocked it from reading files outside the VS Code workspace (the folder a user is working in). An attacker could use prompt injection (tricking the AI by hiding instructions in its input) to make the agent read sensitive files and send that information over the network without user permission, though this attack required the attacker to already control what prompts the agent receives.
LLaMA-Factory, a library for training large language models, has a remote code execution vulnerability (RCE, where attackers can run malicious code on a victim's computer) in versions up to 0.9.3. Attackers can exploit this by uploading a malicious checkpoint file through the web interface, and the victim won't know they've been compromised because the vulnerable code loads files without proper safety checks.
Fix: The source explicitly states: 'The fix is included in DSpace 7.6.4, 8.2, and 9.1. Please upgrade to one of these versions.' For organizations unable to upgrade immediately, the source mentions: 'it is possible to manually patch the DSpace backend' and recommends administrators 'carefully inspect any SAF archives (they did not construct themselves) before importing' and 'affected external services can be disabled to mitigate the ability for payloads to be delivered via external service APIs.'
NVD/CVE DatabaseFix: Update the Hugging Face Transformers library to version 4.52.1 or later, as this version contains the fix for the vulnerability.
NVD/CVE DatabaseFix: Update Roo Code to version 3.22.6 or later, where this vulnerability is fixed.
NVD/CVE DatabaseFix: The issue is fixed in version 4.52.1. Update Hugging Face Transformers to version 4.52.1 or later.
NVD/CVE DatabaseFix: Update to version 4.51.0, where the vulnerability is fixed.
NVD/CVE DatabaseFix: Update to version 4.51.0, where the issue is resolved.
NVD/CVE DatabaseFix: Update to version 4.51.0 or later, where the issue is fixed.
NVD/CVE DatabaseFix: Update to version 2.1.5, where this issue has been patched.
NVD/CVE DatabaseFix: Version 3.20.3 fixes the issue by adding an additional layer of opt-in configuration for auto-approving writing to Roo's configuration files, including all files within the `.roo/` folder.
NVD/CVE DatabaseFix: Upgrade to version 3.20.3 or later. According to the source, "Version 3.20.3 fixed the issue where `search_files` did not respect the setting to limit it to the workspace."
NVD/CVE DatabaseFix: Update to version 0.9.4, which contains a fix for the issue.
NVD/CVE Database