AI & LLM Vulnerabilities

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.11.1 has a security flaw where a namespace collision (a situation where two different things accidentally share the same name or identifier) between user identifiers allows attackers to steal sensitive information and insert unauthorized messages into the system.

IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.11.1 has a vulnerability that allows an attacker to read files they shouldn't have access to through path traversal (a technique where attackers use special file path sequences like "../" to escape intended directories and access restricted files on the system).

IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.11.1 has a security flaw where an attacker without proper credentials can run unauthorized workflows and see private data because the system does not properly verify user identity before allowing access.

IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.11.1 has a vulnerability that allows an attacker who is already logged in to run malicious code on the system because the software doesn't properly control how code is generated. This is a serious security flaw because authenticated users could abuse this to take over the system.

Stable Diffusion WebUI version 1.10.1 and earlier has a security flaw in the /sdapi/v1/cmd-flags endpoint (a web address that returns system settings) that exposes usernames and passwords in plain text. Attackers without needing to log in can access this endpoint to steal login credentials and then use them to break into the application.

Qwen-Agent versions up to 0.0.34 have a path traversal vulnerability (a flaw that lets attackers access files outside the intended directory) in its document parser. Attackers can use the unprotected Gradio interface (a web tool for sharing AI models) to read any files that the server has access to by providing file paths.

Qwen-Agent versions up to 0.0.34 have a server-side request forgery vulnerability (SSRF, where an attacker tricks a server into making requests to unintended locations) in its document parsing feature that doesn't check where file paths actually point to. Attackers can access an unprotected Gradio interface (a tool for building AI demos) to make the server request data from internal systems, like metadata services, and then read that data through the parsed document output.

9router has a critical authentication bypass where attackers can spoof the `Host` header (a message field that tells the server which domain is being accessed) to trick the application into treating their requests as local, granting them unauthenticated access to the `/v1` AI proxy endpoint. This allows attackers to make requests to AI services using the victim's paid API keys, stealing costs and data, or to perform SSRF (server-side request forgery, where the attacker makes the server fetch URLs of their choosing) attacks against internal systems.

## Summary 9router is a software that provides an LLM proxy (a middleman service that connects to AI providers like OpenAI). It's supposed to require an API key (a secret credential) for access, but there's a bypass vulnerability: requests sent to `/codex/*` are secretly rewritten to `/api/v1/responses` by the server configuration, and since the authorization check (middleware, a security layer that runs before the main code) only protects specific paths and doesn't include `/codex`, unauthenti

Datadog tracing libraries have a vulnerability where they parse incoming `tracestate` headers (part of W3C Trace Context, a standard for tracking requests across services) without limiting their size. An attacker can send an extremely large or complex `tracestate` header that forces the server to use excessive CPU and memory, causing a denial of service (DoS, where a service becomes unavailable). Since this parsing is enabled by default, any web service using an affected Datadog tracer version is at risk.

vLLM (a large language model serving framework) versions up to 0.17.0 have a vulnerability where two functions that fetch media files from user-provided URLs do not limit how much data they download, allowing attackers to crash the server by pointing it to extremely large files and exhausting its memory (a DoS or denial of service attack, where a system becomes unusable).