AI & LLM Vulnerabilities

MCP Atlassian (a server that connects AI tools to Atlassian products like Confluence and Jira) had a vulnerability in versions before 0.22.0 where the confluence_upload_attachment function didn't properly validate file paths, allowing an authenticated attacker to read any file the server could access and upload it to Confluence. This could expose sensitive credentials like API tokens if an AI agent is tricked into using this function through untrusted input.

The `ado_package_install` tool in stata-mcp has a command injection vulnerability where user input in the `package` parameter is directly inserted into a Stata command without validation, allowing attackers to inject newline characters and arbitrary Stata commands, including the `shell` command (which runs OS-level code). This leads to RCE (remote code execution, where an attacker can run commands on a system they don't own) with a CVSS score (a 0-10 rating of how severe a vulnerability is) of 8.4 (High), and the tool is enabled by default.

Fujitsu Research's OneCompression library version 1.2.0 has a vulnerability where it unsafely deserializes (converts data back into usable code) checkpoint files using Python's pickle module, allowing attackers to run arbitrary code by providing a malicious model.pt file. When the library loads a model file, it can execute hidden malicious instructions that attackers have embedded in the file, potentially compromising the entire system.

Prowler is a cloud security platform that had a vulnerability in versions before 5.33.1 where authenticated users could trick the system into sending API keys (secret credentials used for authorization) to attacker-controlled or internal endpoints by providing a malicious URL through the Lighthouse provider configuration.

A vulnerability in Snowflake Python API (a library for connecting to Snowflake databases) versions before 1.13.0 allowed attackers to bypass security restrictions through two methods: path traversal (using `..` to access parent resources) and HTTP parameter pollution (injecting special characters like `&`, `#`, `=` to change how requests are interpreted). An attacker who could control certain input values in an application using this library could trick it into executing privileged operations under a higher-permission user account.

Claude Code Templates is a CLI tool with a critical vulnerability in versions before 1.29.4 where its Studio server binds to all network interfaces without authentication and allows attackers to execute arbitrary operating-system commands (running code on a system without permission) by sending specially crafted requests to the /api/execute or /api/install-agent endpoints. An attacker can exploit this by directly accessing the server or tricking a developer into visiting a malicious website, potentially stealing source code, credentials, and local data.

DSPy 3.3.0b1 has a vulnerability where attackers can trick the AI into reading files from a computer and sending them to an attacker-controlled server. The vulnerability exists in the Image and Audio output adapters, which process untrusted outputs from language models (the AI's responses) without proper safety checks, allowing an attacker to inject a file path that the system then reads and encodes into messages.

Cursor is a code editor designed for AI-assisted programming. In versions before 3.0.0 on macOS, a security flaw allowed an agent running in Auto-Run Sandbox mode to launch a privileged container (a lightweight virtual environment) that could access the user's home directory and run commands on the computer without asking for permission first.

Cursor is a code editor designed for programming with AI assistance. Before version 3.1.2, Cursor IDE on macOS had a security flaw where an AI agent running in Auto-Run Sandbox mode (a restricted environment meant to limit what code can do) could trick the system into running malicious Python code outside the sandbox with full user privileges, potentially allowing an attacker to modify files and launch programs. This vulnerability is fixed in version 3.1.2.

CVE-2026-70335 is a vulnerability in GitHub Copilot and Visual Studio Code that allows improper neutralization of special elements in OS commands (OS command injection, where an attacker can execute arbitrary system commands). An unauthorized attacker could exploit this to elevate their privileges locally on an affected system.

CVE-2026-65675 is a vulnerability in Visual Studio Code's CoPilot Chat Extension that allows an unauthorized attacker to bypass a security feature over a network. The vulnerability has not yet been assigned a complete severity rating or detailed weakness classification by NIST.

Intel's oneCCL Bindings for PyTorch (a library that helps PyTorch run on Intel hardware) versions before v2.8.0 have a flaw in their protection mechanism that could let an unprivileged user gain elevated privileges (privilege escalation, meaning gaining admin-level access they shouldn't have). An attacker could exploit this through local access with minimal effort and some basic user interaction.

A protection mechanism failure exists in Intel's LLM Library for PyTorch (a software tool for building machine learning models) that could allow an unprivileged user to gain higher system privileges through a local attack. The vulnerability requires the attacker to have some access to the system and could potentially compromise the confidentiality, integrity, and availability of affected systems.

A protection mechanism failure in Intel Extension for TensorFlow (a library that adds TensorFlow AI capabilities to Intel systems) before version 2.15.0.3 could allow someone with basic system access to gain higher-level privileges, potentially compromising the confidentiality, integrity, and availability of the system. The attack requires local access and low complexity, with passive user interaction.