Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
Quarkus LangChain4j versions 1.9.0 through 1.14.1 contain a missing-release-of-memory flaw in the chat-scopes WebSocket /_chat/routes endpoint. Unauthenticated remote clients can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.
A vulnerability has been found in BerriAI LiteLLM up to 1.94.0, in the get_secret function of secret_managers/main.py within the Secret Resolution component. Manipulating the api_key argument leads to improper authorization, and the attack can be initiated remotely. The exploit is public and may be used, and the vendor did not respond after early contact.
A flaw in BerriAI LiteLLM up to 1.95.0 lies in the function ui_view_session_spend_logs in litellm/proxy/spend_tracking/spend_management_endpoints.py, part of the Spend Tracking component. Manipulating the session_id argument leads to authorization bypass, and the attack can be launched remotely. A published exploit exists.
Fix: Upgrade to version 1.96.0, which resolves the issue. The patch is identified as 722d9ffa4f6c5ae15702ab9ab2c5f6bf1688308b.
JeecgBoot through 3.9.5 has a missing authorization flaw in the promptExperiment handler of AiragPromptsController. Any authenticated user can run AI prompt experiments, including with other users' prompt template and dataset ids, which triggers LLM evaluation runs, writes result rows into airag_ext_data, and changes dataset status.
open-multi-agent (@open-multi-agent/core) versions 1.5.0 through 1.21.2 contain a link following flaw in the file_write tool sandbox. An attacker can plant a dangling symlink in the workspace and use prompt injection to steer the agent into writing attacker-influenced content to any location the agent process can write, outside the workspace root.
phi versions 0.1.1 through 0.28.4 contain an improper link resolution flaw (CVE-2026-108599). Malicious repositories can commit symlinks that point outside the workspace, bypassing workspace_only_writes because the permission gate performs only lexical path checks. Prompt injection can then make the write tool write attacker-influenced content to external files without approval.
Cohere Python SDK versions 5.11.0 through 7.2.0 contain a path traversal (tar slip) flaw in _s3_models_dir_to_tarfile. Its unvalidated tarfile.extractall calls allow arbitrary file writes. An attacker who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.
mini-swe-agent versions 1.10.0 through 2.4.6 contain an information exposure flaw in BubblewrapEnvironment. The bwrap invocation omits --clearenv, so sandboxed commands inherit the host environment. An attacker using prompt injection in processed task content can make the agent read API keys from that environment and exfiltrate them over the shared network.
zotero-mcp versions 0.10.0 through 0.14.1 contain a server-side request forgery flaw in _fetch_embedded_metadata, which fetches URLs without destination validation. An attacker who uses prompt injection to make the agent call zotero_add_by_url can reach loopback, private, or link-local hosts, directly or through redirects, and leak citation meta-tags and error details.
Astron Agent, an agentic workflow platform, prior to 1.1.2 defaults its workflow code-node path (/console-api/workflow/code/run and /workflow/v1/run) to LocalExecutor in core/workflow/engine/nodes/code/code_node.py unless CODE_EXEC_TYPE is changed. LocalExecutor exposes full Python builtins to dynamic code without the documented sandbox restrictions. An authenticated low-privilege tenant can run code as root in the core-workflow container and use shared credentials to bypass tenant checks, read or modify other tenants' data, and disrupt shared services.
Hermes Agent's public GET /auth/native/authorize flow validates redirect_uri with Python's urllib.parse.urlparse but returns the raw, unnormalized value to the browser after login. Python and the WHATWG browser parser handle backslashes differently, so a URL the server accepts as loopback (127.0.0.1) can send the browser to an attacker-controlled origin, which receives the authorization code and state. Because the attacker chooses the PKCE challenge, they can exchange the leaked code for the victim's tokens and take over the session.
Hermes Agent's public POST /auth/password-login route copies the client-supplied provider value into the audit log without any size limit, before rejecting an unknown provider. Because the route is treated as public, an unauthenticated client can cause arbitrarily large, attacker-controlled data to be written persistently to disk. Testing showed a 100 MiB request reduced free disk space from 919 MB to 819 MB, and repeated requests could exhaust disk space and degrade availability.
Hermes Agent's dashboard authentication routes, /auth/native/token, /auth/native/refresh and /auth/password-login, read and parse the full JSON request body before any authentication check, with no application-level size limit. An anonymous client can hold several large uploads open to drive dashboard memory up, which the source reports rising from 721 MiB to 1.08 GiB during testing, creating a denial-of-service risk.
Banks' `Prompt.chat_messages()` method parses every rendered output line as a possible `ChatMessage` JSON object. If attacker-controlled template data renders to JSON such as `{"role":"system","content":"..."}`, Banks returns it as a privileged `system` message rather than plain user text. Applications that render untrusted input with this method and pass the results directly to an LLM provider may be exposed to chat role injection and prompt boundary bypass, with practical impact depending on how the application uses Banks.
The AgentOS server in the praisonai TypeScript/npm package ships with defaults that bind 0.0.0.0, leave the API key empty, and use wildcard CORS with credentials. Because the auth middleware is only registered when an apiKey is set, the documented quickstart exposes GET /api/agents, which returns agent names, roles and instructions, and POST /api/chat, which invokes agents, to any network peer without authentication. The advisory is rated High and was confirmed at runtime.
PraisonAI's shell command hardening, shipped in npm 1.7.2 and Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj and GHSA-vjv9-7m7j-h833, can be bypassed through find's built-in -exec action. The fix blocks shell metacharacters and uses spawn() with shell: false, but find stays in the safe command allowlist, and the batch terminator + replaces the blocked ; so commands run without metacharacters. The same gap exists in four implementations, including the TS shell() tool and the Python safe_shell module, and a find -execdir payload reads /etc/passwd while evading the SandboxExecutor path check.
The AICoder UI component in PraisonAI exposes write_to_file and execute_command tools to the LLM without path validation or command sanitization. Through prompt injection in the chat interface, an attacker can write to arbitrary filesystem locations, such as /root/.ssh/authorized_keys or /etc/crontab, and execute arbitrary shell commands. Docker containers run as root, which increases the impact.
PraisonAI 4.6.63's MCP HTTP-stream server applies authentication only when an API key is set, and the CLI defaults `--api-key` to `None`, so `praisonai mcp serve --transport http-stream` exposes the full MCP surface without authentication. An unauthenticated client can call `initialize` and `tools/list` (about 50 tools), and the dispatcher in `mcp_server/server.py` forwards tool-call arguments to handlers without validating them against the advertised `inputSchema`. The source states this is not an RCE or file read in 4.6.63, because `workflow.run` and `workflow.run_file` fail at runtime.
PraisonAI's Async Jobs API enables API-key middleware only when PRAISONAI_JOBS_API_KEY is set, so all endpoints are unauthenticated by default. An unauthenticated POST /api/v1/runs accepts an attacker-controlled webhook_url, and the server POSTs job payloads to it via httpx, with a DNS-rebinding bypass of the request-time SSRF check that reaches internal services as a blind SSRF.
Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers forwarded unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refresh tokens, or a derived Anthropic API key, that were meant to stay outside the sandbox.
Fix: This issue is fixed in version 1.1.2.