AI & LLM Vulnerabilities

GitLab EE (Enterprise Edition, a version of the GitLab code management platform with extra features) had a security flaw where authenticated users with developer-role permissions could run arbitrary commands (any code they wanted) in a CI context (continuous integration, the automated testing and deployment process) because a Claude agent was reading configuration from user-controlled sources without proper validation. GitLab has now fixed this issue.

Chainlit versions 2.4.0 through 2.11.x have a Server-Side Request Forgery vulnerability (SSRF, where an attacker tricks a server into making requests to unintended targets) in the MCP (Model Context Protocol) feature that is disabled by default. When MCP is enabled, an unauthenticated attacker can force the Chainlit server to make HTTP requests to internal network services or cloud metadata endpoints by sending a crafted request to the `/mcp` endpoint with a malicious URL and custom headers like Authorization and Cookie.

Dradis Community Edition has a broken authorization check in its ProvidersController and AgentsController because they check for a constant that never exists, allowing any logged-in non-admin user to create fake AI providers pointing to arbitrary websites. When triggered, the server makes requests to these attacker-controlled URLs (SSRF, or server-side request forgery, where a server is tricked into making requests to unintended targets) and leaks the responses back to the attacker through error messages.

A security flaw (CVE-2026-78379) in Strands Agents Tools, a Python SDK for building AI agents, allows attackers to bypass the approval prompt in the python_repl tool (which normally requires human consent before running Python code on a system). An attacker can craft a malicious prompt that uses the batch tool to sneak in a keyword argument, letting them execute arbitrary Python code without permission.

browse-mcp versions before 0.8.2 had a critical security flaw where file download and state management functions didn't properly check file paths, allowing attackers to write files to any location on the system (like startup scripts or configuration files) and potentially execute code. The vulnerability could be exploited by malicious MCP clients (software components that interact with the browser tool) or through prompt injection (tricking an AI by hiding instructions in web page content).

The qwed package (version 5.1.1) has a critical vulnerability where user-supplied mathematical expressions are passed directly to SymPy's `parse_expr()` function without restrictions. Since `parse_expr()` internally uses Python's `eval()` (a function that runs arbitrary code), any authenticated user can execute malicious Python code on the server, leading to complete compromise. An attacker only needs to create a free account through the signup endpoint to exploit this.

Vocos, an AI model loading library, has a security flaw where it loads and runs any code specified in a configuration file without checking if that code is safe (instantiate_class, a function that creates objects based on config file instructions, doesn't use an allowlist to restrict which classes can be loaded). This means if you load a model from an untrusted source, the attacker who controls that source can run arbitrary code on your computer during the loading process.

Nokogiri versions before 1.19.3 have a ReDoS vulnerability (regular expression denial of service, where carefully crafted input causes a regex pattern to take exponentially longer to process) in how it parses CSS selectors. Attackers can exploit this by injecting malicious CSS selectors into methods like Node#css and Node#at_css to make the application hang or crash.

A vulnerability in the utcp-http library allows attackers to bypass URL validation through HTTP redirects. When a tool is invoked, the library validates the initial URL but then follows redirects without re-checking where they lead, allowing an attacker to redirect the request to internal services like cloud metadata endpoints (systems that store sensitive configuration data) and steal the response. This is a form of SSRF (server-side request forgery, where an attacker tricks a server into making requests to unintended targets).

mcp-shell has two security flaws that disable protections in both deployment methods. By default, security is turned off (opt-in instead of opt-out), so users following the standard installation instructions run an unrestricted shell server where any connected LLM can execute arbitrary commands through prompt injection. Additionally, even Docker users who enable "secure mode" can bypass it by calling allowed programs like bash or python with flags that create interactive shells, giving the LLM direct command execution.

mcp-shell has a security flaw where its default configuration allows `/bin/bash` as an allowed command, but the validator only checks the first word of a command and ignores flags like `-c`. This means an attacker can send `/bin/bash -c <any-command>` to bypass the allowlist (a restrictions list) and run any command on the system, such as `id` or `curl`, with no authentication needed.

mcp-shell's secure mode is supposed to restrict which programs can run, but it has a bypass vulnerability. An attacker can use a Git feature (shell aliases, triggered by the `!` character) to run any command they want, even though the security checker blocks other dangerous characters. The default Docker setup runs this vulnerable version without protection, so anyone who can send commands can take over the system.

PraisonAI's HTTP server has a flaw in how it checks which websites are allowed to make requests to it, using a prefix match that allows attackers to bypass it by registering domains like 'localhost.attacker.com'. Combined with no default authentication and no requirement for session validation, an attacker can trick a victim into visiting a malicious webpage that silently makes requests to the victim's local PraisonAI server to create rules that inject the attacker's instructions into all future agent runs on that machine.

PraisonAI's Jobs API (a FastAPI service that runs AI agent jobs) has no authentication checks on any of its endpoints. This means anyone who can reach the server can submit jobs to run against the system's AI credentials, view all jobs and their results, cancel running jobs, and delete completed jobs without providing any token, password, or proof of identity. The vulnerability is separate from a similar bug that was already fixed in an older Flask-based API component, but this FastAPI jobs module was left unpatched.