Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
Roo Code through 3.54.0 contains a command approval bypass in the quote-masking regex of parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separators behind allowlisted prefixes such as echo, so commands run without user approval.
Roo Code through 3.54.0 has a command approval bypass in getCommandDecision(). A bare >& redirect prefix makes the allowlist auto-approve shell commands the user denied.
CVE-2026-109429 affects Mistral Vibe before 2.25.4 and contains a bypass of its command permission gate. Tree-sitter-bash static parsing misses a command substitution hidden inside a single-quoted variable value, which the attacker re-expands with the ${var@P} prompt-transform operator so bash's promptvars feature runs it at runtime. Only the trailing allowlisted command is classified, so arbitrary commands run silently with the privileges of the agent's terminal session.
Mistral Vibe before 2.25.5 has a permission validation bypass in the _extract_commands() function of bash.py. A parsing mismatch between tree-sitter-bash and bash over backslash-newline line continuations lets an attacker hide a command, such as a curl request, behind an allowlisted prefix like cd, so resolve_permission grants ALWAYS permission and bash runs unauthorized commands.
A vulnerability in conductor-oss conductor up to 3.32.5 affects the function A2AService.getAgentCard in ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java, within the Agent Card Fetching component. Manipulating the agentUrl argument can lead to server-side request forgery. The attack can be launched remotely, and a public exploit has been disclosed.
A weakness in TensorLayer up to 2.2.4 affects the load_hdf5_graph function in tensorlayer/files/utils.py, within the HDF5 Loading component. Manipulating the model_config argument can lead to deserialization, and the attack can be carried out remotely. A public exploit is available, and the project was notified through an issue report but has not yet responded.
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Under certain conditions, an authenticated user could inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users. The cause is improper neutralization of special elements in AI conversation context construction.
A vulnerability in EricLBuehler Mistral.rs up to 0.9.3 lies in the calibration_apply function of mistralrs-server-core/src/handlers.rs. Manipulating the save_cimatrix argument leads to path traversal, and the attack can be launched remotely. A public exploit exists.
Fix: Upgrading to version 0.9.4 is sufficient to fix this issue. The patch is named 8c81056712709b4845ec6d9531e4d35bab4a367c. It is suggested to upgrade the affected component.
CVE-2026-108939 affects EricLBuehler mistral.rs up to 0.9.3. Manipulating the ip argument of the is_global_ip function in mistralrs-server-core/src/media_source.rs enables remote server-side request forgery, and the exploit is publicly disclosed.
Fix: Upgrade to version 0.9.4. The patch is cfb8c6a0c42361dc4579a9110b54d339c255b9fd.
NVD/CVE DatabaseNginx UI, a web user interface for the Nginx web server, has a flaw in versions prior to 2.4.1. Its validation control, ValidateConfigFile in internal/config/validation.go, blocks dangerous directives such as js_*, perl_*, load_module for the njs and perl modules, and user root, but the MCP tool nginx_config_add (mcp/config/config_add.go) never calls it and writes caller-supplied content directly to disk before reloading nginx. An authenticated MCP caller, or an MCP agent manipulated through prompt injection, can therefore inject the blocked directives and achieve code execution in nginx on deployments where the njs or perl module is available, such as the official Docker image.
Network-AI versions from 5.14.0 before 5.15.2 contain a security control bypass in the ClaudeHookBridge PreToolUse hook. The hook matches denyPatterns only against the first present candidate field, so a prompt-injected agent can place dangerous payloads in fields such as Write content or an MCP script parameter alongside a benign file_path or command, evading the deny rules to write web shells or execute scripts.
vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback after only a file-size check, exposing FFmpeg's IAMF parser to a heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.
Open WebUI before 0.11.4 has a missing authorization flaw that lets authenticated users reach model provider backends that are disabled. By supplying an explicit backend index as a path segment or query parameter on the Ollama and OpenAI-compatible listing routes, an attacker can trigger requests carrying configured API keys, read version strings, and enumerate connections.
Open WebUI from 0.6.27 before 0.11.4 forwards the full browser cookie jar to destination servers on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrator accounts.
Fix: Fixed in 0.11.4.
NVD/CVE Databasemac-shell-mcp before 2.0.0 contains an OS command injection flaw in its execute_command arguments. Attackers or malicious prompts can pass shell metacharacters, such as ';' after a whitelisted command like pwd, to run forbidden commands as the server user without approval, bypassing the command whitelist.
A vulnerability in Ollama up to 0.34.1 lies in the function IsValid in types/model/name.go, part of the Pull API. Manipulating it leads to server-side request forgery, and it can be exploited remotely. The exploit is public.
Fix: Upgrading to version 0.34.2 is sufficient to fix this issue. The identifier of the patch is dfabde4539e42ba1e1eab50a3a50b88aea7958a0. It is suggested to upgrade the affected component.
NVD/CVE DatabaseA missing authorization flaw (CWE-863-style access control misconfiguration, as the source describes it as 'Exploiting Incorrectly Configured Access Control Security Levels') affects VideoWhisper Site Manager for ChatGPT, Claude, Codex (videowhisper-site-manager) from n/a through 1.2.10. The source tracks it as CVE-2026-107430 and does not describe the attack path or what an attacker gains.
mistral.rs versions 0.9.0 through 0.9.4 contain a link following flaw in mistralrs-code-exec. Sandboxed shell code can read and overwrite files outside the sandbox through symlinks, and attackers or prompt-injected agents can exploit this by naming symlinks as outputs or reusing sessions with symlinked input paths. Access runs with the server process's permissions.
Abilityai Trinity through 0.9.5 has a missing authorization flaw in its Telegram router. Agent-scoped MCP API keys can perform binding operations that are meant only for humans. An attacker who controls an agent, typically through prompt injection, can send messages through the owner's bot token, replace the binding with their own token, or delete the binding.
GPT-Load through 1.4.11 logs client proxy keys in cleartext. The Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Anyone with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.
Fix: Fixed in version 2.4.1.
NVD/CVE Database