AI & LLM Vulnerabilities

Trigger.dev, a platform for building AI agents and workflows, had a security flaw in versions 4.4.2 through 4.5.0-rc.4 where an API endpoint didn't properly check which environment a user belonged to before replaying task runs (a process that re-executes a previous job). This allowed someone with a valid API key to replay another organization's tasks, waste their resources, and potentially execute malicious code by overwriting task data through a separate vulnerability.

A security flaw in Kibana (Elastic's data visualization tool) Machine Learning allows users to remove trained models (pre-built AI models) from a workspace if they have permission to create certain types of jobs, even if they shouldn't have that permission. The actual model isn't deleted and can be restored by someone with proper access, but this is still a privilege escalation vulnerability (a situation where someone gains more control than they should have).

vLLM (an AI model serving system) versions 0.19.0 to 0.26.0 have a vulnerability where the /v1/completions endpoint accepts unlimited lists of prompts, causing the system to create excessive processing tasks. An authenticated attacker could send a single request with many prompts to overwhelm the server's CPU, memory, and scheduling capacity, making it unavailable to other users.

vLLM is an inference and serving engine for large language models that had an integer overflow bug (a math error where a number gets too large for its storage space) in versions before 0.27.0. This bug could cause one user's AI inference result (the AI's output) to leak to another user processing a request in the same batch, exposing private data.

vLLM (a system for running and serving large language models) has a vulnerability in versions before 0.26.0 where the structured_outputs.regex parameter accepts user input without validation, allowing attackers to submit specially crafted regular expressions (patterns for matching text) that consume excessive CPU resources and freeze the system. An unauthenticated attacker can exploit this through the /v1/completions endpoint without needing a password or credentials.

vLLM, a software that runs and serves large language models, has a security flaw in versions before 0.26.0 where error messages from malformed requests reveal sensitive information like the operating system username, file paths, and internal code details to anyone who sends specially crafted requests. The problem occurs because the error handling code doesn't properly hide sensitive details when something goes wrong.

In @jshookmcp/jshook version 0.3.1, an MCP server (a tool that gives AI agents JavaScript analysis capabilities) has a security gap where ICMP probe and traceroute tools bypass SSRF protections (security rules that block access to private internal networks). This allows an attacker with access to the server to map internal networks and probe private addresses that should be blocked.

HCL AION has a vulnerability where indirect prompt injection (tricking an AI by hiding malicious instructions in its input data) can lead to HTML injection (inserting harmful web code) in the output that users see. This could cause unintended behavior or security problems depending on how the system is used.

Flowise versions before 3.1.4 have a security flaw in their text-to-speech endpoint that doesn't properly check if users should have access to private chatflows (the conversation flows that power the AI). This means attackers can use someone else's private chatflow without logging in, and generate unlimited audio files using that chatflow owner's paid API keys (like OpenAI or ElevenLabs), costing the owner money.