AI & LLM Vulnerabilities

OpenClaude's BashTool exposes a `dangerouslyDisableSandbox` parameter that an LLM can control, allowing it to bypass the sandbox (a restricted execution environment) and run arbitrary commands on the host system. The vulnerability exists because this security-critical flag defaults to allowing unsandboxed commands, contradicting the project's own threat model which states the LLM should not be trusted.

The Adversarial Robustness Toolbox (ART) version 1.20.1 and earlier has a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability in its Kubeflow component. The vulnerability exists because the robustness evaluation function uses eval() (a function that executes text as Python code) without checking user input, allowing an attacker to submit malicious Python code that runs on the system when the evaluation function processes it.

The snorkel library (a tool for machine learning data labeling) versions up to 0.10.0 has a security flaw in its MultitaskClassifier.load() method that allows arbitrary code execution (running any commands an attacker wants on your computer). The problem occurs because the method uses torch.load() without the weights_only=True security setting, which means it can deserialize (reconstruct) malicious Python objects from model files that an attacker provides.

The snorkel library (a machine learning tool for data labeling) versions up to 0.10.0 has a critical vulnerability in its BaseLabeler.load() method, which uses pickle.load() (a Python function that converts saved data back into usable objects) on user files without checking if they're safe. An attacker can create a malicious file that executes harmful code on a victim's computer when the file is loaded.

PyTorch-Lightning versions 2.6.0 and earlier have a vulnerability in their checkpoint loading function that allows attackers to execute arbitrary code (running any commands they want on a victim's computer) by providing a malicious checkpoint file. The problem occurs because the code uses torch.load() without the weights_only=True parameter, which means it can deserialize (reconstruct) any Python object, including dangerous ones hidden in the checkpoint file.

A bug in the optimate project's neural_magic_training.py script allows attackers to run arbitrary code on a victim's computer by providing a malicious model file. The vulnerability exists because the _load_model() function uses torch.load() without the weights_only=True parameter, which means it can deserialize (reconstruct) any Python object from a file, including malicious ones hidden in .pt or .pth files.

A vulnerability in the optimate project's _load_model() function allows attackers to run arbitrary code on a victim's computer by providing a malicious model file. The problem occurs because the function uses torch.load() without the weights_only=True parameter, which means it can deserialize (convert data back into Python objects) any Python code hidden in a .pt file, not just safe model weights.

A script called torch-checkpoint-shrink.py in the ml-engineering project has an insecure deserialization vulnerability (CWE-502, a weakness where untrusted data is converted back into objects without proper validation). The script uses torch.load() to read PyTorch checkpoint files (.pt) without the weights_only=True security setting, which allows attackers to execute arbitrary code (run any commands they want) by providing a malicious checkpoint file. An attacker can exploit this remotely by tricking a user into loading a specially crafted file.

DeepChat, an open-source AI platform combining models, tools, and agents, has a vulnerability in versions before v1.0.4-beta.1 that allows remote code execution (RCE, where an attacker can run commands on a system they don't own). An attacker can use a malicious link in Markdown or a compromised AI endpoint to bypass security checks and execute arbitrary commands by exploiting unprotected pop-up window handlers in the application.

SOCFortress CoPilot, a security operations management tool, has a critical flaw in versions before 0.1.57 where it uses a hardcoded JWT signing secret (a fixed password used to create secure authentication tokens) as a fallback. If users don't manually set their own JWT_SECRET, the application uses this publicly known secret, allowing attackers to forge fake admin tokens and take complete control without needing real credentials. This vulnerability is fixed in version 0.1.57.

MLflow versions 3.9.0 and earlier contain a vulnerability where unauthenticated attackers can read arbitrary files from a server by exploiting a flaw in the `_create_model_version()` handler (a function that processes requests to create new model versions). An attacker can trick the system into storing any file path from the server's filesystem by using a special tag in their request, and then retrieve those files through a different function that doesn't properly check permissions.

CosyVoice, a text-to-speech framework, has an insecure deserialization vulnerability (CWE-502, a weakness where untrusted data is converted back into executable objects) in how it loads model files. The vulnerability exists because the code uses torch.load() without the weights_only=True security setting, allowing attackers to execute arbitrary code (malicious instructions) on a victim's computer by tricking them into loading a specially crafted model file through the CosyVoice Web UI.

CosyVoice (a speech synthesis tool) has an insecure deserialization vulnerability (CWE-502, a flaw where untrusted data is converted back into executable code) in its gRPC server (a framework for building networked services). The vulnerability occurs because the server uses torch.load() without the weights_only=True parameter to load speech models, allowing an attacker to execute arbitrary code by placing malicious model files in a directory that a victim then loads.