Advisories

CVE-2026-88981 affects Kubeflow Pipelines before 2.18.0. The frontend artifact download path for source=s3 or source=minio, and the archived pod-log path, accept endpoint values from request or workflow metadata without checking them against operator-controlled storage configuration. In the shipped authorization-disabled standalone configuration, an unauthenticated caller can make the shared ml-pipeline-ui pod connect to arbitrary reachable hosts and return response data, and may reveal an access-key identifier when requests are signed with configured object-store credentials.

Prior to 2.18.0, Kubeflow Pipelines' frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host that the URL parser converts to an IPv4 address. Under the default ALLOWED_ARTIFACT_DOMAIN_REGEX and the authorization-disabled standalone configuration, an unauthenticated caller can fetch internal HTTP resources and receive their response body, while in the authenticated multi-user configuration a low-privilege tenant with a valid identity and authorized namespace can reach the same defect.

AG2 versions from 0.13.2 through 1.1.1, and autogen from 0.13.2 through 0.14.1, are affected by a flaw in SandboxShellTool when configured with allowed=[...] or readonly=True. The command filter in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py does not treat newline or carriage-return characters as separators, while the raw string is passed to sh -c, so an attacker-influenced agent command can run an additional arbitrary statement. With the default LocalEnvironment backend, that statement runs as a host subprocess with the agent process's privileges, affecting confidentiality, integrity, and availability.

Code Graph RAG versions before 0.0.589 resolve file paths lexically when checking project containment, so a symbolic link inside an analyzed repository can point to a file outside the configured root. The structural_search tool discloses that content without an approval gate, and structural_replace with dry_run=False can overwrite it, including through the MCP path, which skips the agent-loop approval control. An attacker who gets a victim to analyze such a repository can read credentials or environment files and modify files the process can write.

Codex Desktop for Windows does not correctly check quotation marks in project paths received from Windows Explorer. When a user selects "Open project in ChatGPT" on a child item of an attacker-controlled library, the path can inject application startup arguments. Those arguments can run attacker-controlled code with the current Windows user's permissions, before sign-in or project trust approval.

The banks package (2.4.2, latest per the report) resolves each Tool's import_path with importlib.import_module and getattr in src/banks/extensions/completion.py, with no allowlist or validation on the field. Tool JSON parsed from the rendered body of a {% completion %} block can name any importable attribute, such as os.system, and when the LLM emits a matching tool_calls entry the callable runs with arguments from the model output, giving arbitrary code execution in the banks-hosting process. The report states this is distinct from GHSA-gphh-9q3h-jgpp / CVE-2026-44209, whose 2.4.2 fix (switching env.py to SandboxedEnvironment) does not cover this path.

A weakness in eosphoros-ai DB-GPT up to 0.8.2 affects the exec_module function in hf_adapter.py, part of the HuggingFace Adapter component. Manipulating the trust_remote_code argument can lead to inclusion of functionality from an untrusted control sphere, and the attack can be launched remotely. A public exploit exists, and the project was informed through an issue report but has not responded yet.

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability in project context collection. A crafted repository that sets gpg.program and log.showSignature, combined with a signed commit, causes git log to run the attacker's program at session start, before any trust prompt.

Mistral Vibe before 2.25.7 contains a remote code execution flaw, tracked as CVE-2026-122134. An attacker can configure malicious Git clean or process filter drivers in a repository, and when a user opens that crafted repository, ProjectContextProvider._fetch_git_status runs git status at startup. This invokes the filters and executes the attacker's commands with user privileges before any trust prompt is shown.

Mistral Vibe before 2.25.5 on Windows contains an untrusted search path flaw. An attacker can place a malicious git.exe in a repository root, and SessionLogger and ProjectContextProvider run it at session start before any trust prompt, so luring a user into opening a crafted repository is enough to execute code.