Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
IBM Langflow OSS versions 1.0.0 through 1.11.2 have a security weakness where attackers who are logged in can trick the system into thinking they are accessing from localhost (the local computer) by faking an X-Forwarded-For header (a piece of information that says where a request came from). This allows them to bypass security restrictions and modify important configuration files that control IDE (integrated development environment, the tool programmers use to write code) settings.
IBM Langflow OSS versions 1.0.0 through 1.11.2 have a vulnerability where an authenticated attacker can write arbitrary files (any file they choose) to the server. The problem occurs because the SaveToFileComponent doesn't properly validate user input when processing requests, allowing attackers to use path traversal (special sequences that navigate to different directories) to write files outside the intended location.
IBM Langflow OSS (an open-source software tool) versions 1.0.0 through 1.11.2 have a stored cross-site scripting vulnerability (XSS, a type of security flaw where malicious code gets saved in a system and runs when users view it) in its Playground chat feature. This means attackers could inject harmful code through the chat that would execute for other users.
FastChat has a security flaw in its /register_worker endpoint (a part of the software that handles worker registration) where attackers don't need to log in to register fake workers that can intercept user data like prompts and responses. Attackers can also use this vulnerability to perform SSRF (server-side request forgery, where they trick the server into making requests to internal networks it shouldn't access) to probe internal network ports.
LaVague version 0.2.35 has a remote code execution vulnerability (RCE, where attackers can run commands on a system they don't own) in a component called PythonFromMarkdownExtractor.extract_as_object that unsafely runs Python code generated by an AI model. Attackers can exploit this by injecting malicious code through web pages using indirect prompt injection (tricking the AI by hiding instructions in web content), allowing them to execute harmful commands on the operator's computer without any human review.
ms-swift 4.5.2 has a server-side request forgery vulnerability (SSRF, where an attacker tricks a server into making requests to places it shouldn't), in its OpenAI-compatible API that handles media files. Attackers without authentication can provide fake image, audio, or video URLs that force the server to request internal services and cloud metadata, potentially exposing sensitive information.
OWL's DocumentProcessingToolkit has a server-side request forgery (SSRF, a vulnerability where an attacker tricks a server into fetching URLs it shouldn't access) vulnerability in its extract_document_content tool. Attackers can use prompt injection (tricking an AI by hiding instructions in its input) to supply malicious URLs that make the server fetch internal resources, and the results are sent back to the AI agent where the attacker can see them.
LLaMA-Factory, an AI model tool, has a security flaw where its API (application programming interface) that mimics OpenAI's system fails to properly block requests to internal servers. Attackers can bypass this protection using HTTP redirects (where a website sends you to another location) or DNS rebinding (tricking the system into looking up a different address) to access sensitive internal data and cloud metadata endpoints (services that store configuration information).
OGX (formerly Llama Stack) has a vulnerability where its OpenAI-compatible API endpoint accepts a server_url parameter without checking if it points to safe locations, allowing unauthenticated attackers to make the server connect to arbitrary internal addresses (like cloud metadata endpoints that contain sensitive credentials) and send attacker-controlled data to those locations. This SSRF (server-side request forgery, where an attacker tricks a server into making requests the attacker shouldn't be able to make directly) happens because the validation function used elsewhere is not applied to this specific parameter.
Copilot Studio has a security flaw where it fails to properly verify cryptographic signatures (mathematical proofs that data comes from a trusted source), allowing an attacker to gain elevated privileges (higher access levels) on a network without authorization.
Agentimus, a plugin that integrates AI and SEO tools with AI agents, has a broken access control vulnerability (a security flaw where users can access data or features they shouldn't be able to) in version 1.51.0 and earlier. This flaw specifically affects the subscriber functionality, meaning attackers could potentially access subscriber-level features or data without proper authorization.
Ollama (an AI model management tool) doesn't properly check where it's being redirected to when downloading tensor-layer models (the numerical data that makes AI models work). This allows attackers to trick Ollama into downloading files from malicious servers or even requesting sensitive information from internal cloud systems that should be private.
Helicone, a platform for managing AI services, has a security flaw in its VaultManager.getDecryptedProviderKeyById() function (the code that retrieves and decrypts API keys) where it doesn't check whether the person requesting a key actually belongs to the organization that owns it. This means attackers with admin or owner privileges in one organization can steal decrypted API keys (like OpenAI or Anthropic credentials) from completely different organizations.
The CKAN MCP Server has a cache-key collision vulnerability where different parameter sets can produce the same cache key, allowing an attacker to poison the cache (store malicious data in it) so that other users receive wrong results. The problem occurs because the cache key creation doesn't properly escape special characters like '&' and '=', so two genuinely different queries can be treated as identical and share the same cached response.
LiteLLM is a proxy server (a middleman program that forwards requests) that lets users call AI language model APIs using OpenAI's format. Before versions 1.88.6 and 1.96.2, authenticated users could trick the proxy into sending secret credentials (like API keys) to a destination they control by exploiting incomplete validation (security checks) in the request processing code.
claude-skill-antivirus has a vulnerability where it only scans SKILL.md (a manifest file describing what a skill does) but ignores actual executable files like Python scripts and compiled code when checking skill packages for safety. This means attackers can hide malicious code in the executable files while the manifest stays clean, causing the tool to incorrectly mark dangerous skills as completely safe.
A vulnerability in Kibana's machine learning feature (a tool for analyzing data patterns) allows authenticated users (people who have logged in) to access and use machine learning functions they shouldn't have permission to use, which can waste valuable computing resources. The problem stems from incorrect authorization (CWE-863, a flaw where access controls don't properly restrict who can do what), and attackers exploit misconfigured access control settings to gain unauthorized abilities.
A flaw in Kibana's machine learning feature allows an authenticated user with job management privileges in one space (an isolated area in Kibana) to accidentally make a job's saved object accessible across all spaces in the system, even if they don't have permission to access those other spaces. This could expose sensitive information to users who shouldn't see it.
A vulnerability in the CKAN MCP Server allows attackers to bypass a security check that restricts certain tools to only use `dati.gov.it`. The validation uses an unanchored regex (a pattern that doesn't fully check where the text ends), allowing URLs like `https://dati.gov.it.attacker.com` or `https://dati.gov.it@attacker.com` to pass the check while actually connecting to attacker-controlled servers. This lets attackers intercept requests, spoof responses, and potentially inject malicious content into the AI model's answers.
A bug in Tiptap's mergeAttributes() function allows attackers to manipulate an object's prototype (the internal template that defines inherited properties) by passing a JSON object with a `__proto__` key. When this manipulated object is used to create DOM elements in ProseMirror (a document editing library), the hidden inherited properties can be converted into HTML attributes like event handlers, potentially allowing attackers to run malicious JavaScript code.
Fix: The source recommends: 'Build the cache key from an unambiguous, injection-proof encoding: hash a structured, canonical JSON (with typed values) or percent-encode/escape each key and value before joining, and use a separator that cannot appear in the encoded fields. Include a type tag so `{a:{...}}` (object) and `{a:"..."}` (string) never coincide.' Additionally, 'Consider partitioning the cache per client/tenant on shared deployments so one client cannot influence another's entries.'
GitHub Advisory DatabaseFix: Update LiteLLM to version 1.88.6 or 1.96.2, which fixed the incomplete request validation checks in the proxy code.
NVD/CVE DatabaseFix: The source recommends validating the parsed host instead of the raw string: use `new URL(serverUrl)` to parse the URL, then verify the hostname equals either `dati.gov.it` or `www.dati.gov.it` (in lowercase). The source states: 'Anchoring the regex end-to-end (`/^https:\/\/(www\.)?dati\.gov\.it(\/|$)/i`) also closes the suffix trick, but URL-parsing + exact host comparison is the robust fix and also neutralizes the `@`-userinfo variant.'
GitHub Advisory DatabaseFix: The source recommends: 'Reject `__proto__` before reading or assigning the key, or define copied keys as own data properties without invoking legacy setters. A minimal hardening is to skip `key === '__proto__'`. Add regression tests using an own JSON-origin `__proto__` key and assert that the result keeps `Object.prototype` as its prototype, exposes no inherited attacker keys, and cannot create an event-handler attribute through `DOMSerializer`.' No fixed release version is mentioned in the source.
GitHub Advisory Database