AI & LLM Vulnerabilities

# Analysis ## Summary The Contentful MCP Server tools `export_space` and `import_space` accept LLM-controlled parameters like `host` and `proxy` that are passed directly to the API client without filtering, allowing an attacker to redirect the server's API credentials (a Personal Access Token, or PAT) to their own server. An attacker can exploit this by directly calling these tools with a malicious `host` parameter, or by embedding instructions in Contentful content that trick the LLM into mak

claude-faf-mcp (a tool that helps Claude interact with projects) had a security flaw where it didn't properly limit which files users could read or write. An attacker could use prompt injection (tricking the AI by hiding instructions in user input) to read sensitive files like SSH keys or cloud credentials stored outside the intended project folder. The vulnerability affected file-reading and file-writing tools that accepted file paths without proper restrictions.

faf-mcp (a tool that helps AI assistants work with files) had a security flaw where it accepted file paths from callers without properly restricting access to a safe directory. This meant an attacker could trick the system into reading sensitive files like SSH keys or cloud credentials, or writing files outside the intended project folder, by using absolute paths or directory-traversal tricks (like `../`). The vulnerability could be exploited through prompt injection (hiding malicious instructions in user-provided content that an AI processes).

Several tools in grok-faf-mcp (a server that helps AI assistants work with project files) accept a file path argument from users without properly checking that the path stays within the intended project folder. This means an attacker could use path tricks like `../` or absolute paths to read any file on the system that the server process can access, including SSH keys, cloud credentials, or environment files. An LLM (large language model) could even be tricked via prompt injection (hiding instructions in user-supplied content like web pages or README files) into making these malicious file-read requests.

IBM Langflow OSS versions 1.0.0 through 1.10.0 have a security flaw where the registration endpoint lacks authentication (a check to verify who is making requests), allowing remote attackers to change the administrator's email address and potentially use the server to send spam or malicious emails. This vulnerability is classified as CWE-306 (missing authentication for critical function).

The `NumpyReader` class in MONAI uses `np.load()` with `allow_pickle=True` (a setting that lets Python execute code hidden in data files) hardcoded, allowing attackers to run arbitrary code by distributing malicious `.npy` or `.npz` files. This vulnerability affects all MONAI versions and cannot be overridden by users, since the code explicitly prevents the `allow_pickle` parameter from being changed.

MONAI version 1.5.2 still contains a critical remote code execution (RCE) vulnerability in the `algo_from_pickle()` function, despite an earlier security advisory claiming it was patched. The vulnerable code uses `pickle.loads()` (a function that converts serialized Python objects back into code, which can execute malicious instructions) without any safety checks, allowing an attacker to run arbitrary commands if they provide a specially crafted file to the function.

CVE-2026-47629 is a vulnerability in NVIDIA Triton Inference Server for Linux that involves improper input validation (the failure to check that data entering a system is safe and correctly formatted), which could allow an attacker to cause a denial of service (making the service unavailable to legitimate users). The vulnerability has a CVSS 4.0 severity rating, though a detailed assessment is not yet available.

NVIDIA Triton Inference Server for Linux contains a vulnerability (CVE-2026-47628) that allows an attacker to allocate unlimited resources, potentially causing a denial of service (a situation where a system becomes unavailable to legitimate users). The vulnerability is classified as CWE-770, which refers to allocation of resources without limits or throttling (controls that prevent excessive resource use).

The Apify MCP server (a tool that lets AI agents scrape and extract data from websites) had a vulnerability where malicious actors could redirect connections to fake servers and steal API tokens (security credentials that grant access to accounts and data). An attacker needed to trick someone into using their malicious actor for this to work.

GeoLens had multiple authorization bypass vulnerabilities where the system only checked permission for the resource named in the URL but failed to re-check permission for a second dataset accessed through relationships or references, allowing attackers to read private dataset metadata, table rows, vector tiles (map feature data), and raster pixels (image pixel values). Some vulnerabilities required no login at all, while others only needed a default user account. All issues are fixed in version 1.2.3.

CodeWhale versions 0.8.41 through 0.8.63 have a remote code execution vulnerability (the ability for attackers to run code on your machine) in the rlm_eval tool. The tool automatically approves and runs Python code supplied by an AI model without asking the user for permission or checking their security settings, allowing attackers to inject malicious instructions into web pages or files that the AI reads and then executes on the user's computer at their privilege level.