AI & LLM Vulnerabilities

Flowise has a missing authorization bug in the `/api/v1/files` endpoint that allows any API key within an organization to list and delete files from other workspaces, even if that API key has no permission to access files. The endpoint only checks if files are enabled as a feature, but does not verify that the API key has permission to access files in that specific workspace, breaking the isolation between workspaces.

Flowise has a vulnerability where the OAuth2 token refresh endpoint is publicly accessible without authentication and makes server-side HTTP requests to attacker-controlled URLs without protections (SSRF, or server-side request forgery, where an attacker tricks a server into making requests on their behalf). This allows attackers to see the full response from their target server and steal sensitive OAuth2 secrets like client IDs and refresh tokens that get sent in the request body.

The python-cryptography library has a vulnerability in its certificate chain validation where duplicate self-signed certificates cause exponential slowdown during processing. An attacker can craft a malicious certificate chain that takes over 5 seconds to reject, potentially causing a denial of service (resource exhaustion attack, where a system runs out of computing power by being forced to do too much work).

Ouroboros, a local-first runtime for AI coding agents that enforces security policies, had a vulnerability in versions before 0.42.1 where its denylist (a list of blocked actions) was incomplete. A malicious cloned repository could bypass security controls by using environment variables (configuration settings stored in a .env file) that weren't on the denylist, allowing arbitrary command execution (RCE, where an attacker runs commands on a system they don't own). The vulnerability existed because previous fixes missed several environment variable keys that could be exploited to weaken or bypass the approval system.

A prompt injection vulnerability (tricking an AI by hiding instructions in its input) in the shell tool of Amazon Strands Agents Tools before version 0.8.0 allows attackers to run arbitrary operating system commands on the agent's host computer by crafting a prompt that sets the non_interactive parameter to true, which bypasses the requirement for human approval.

Strands Agents Tools, an open-source SDK for building AI agents, has a vulnerability where the shell tool (which runs operating system commands) can be tricked by prompt injection (hiding malicious instructions in text the AI reads) to bypass its human approval requirement. An attacker could craft input that sets a hidden parameter to true, allowing commands to execute on the system without the operator's permission.

The brace-expansion library has a denial-of-service vulnerability where a previous security fix (from version 5.0.8) was incomplete. Attackers can send specially crafted input to crash the Node process with an out-of-memory error, or cause it to freeze for over two minutes, because intermediate arrays created during expansion are not properly limited even though the final output is.

A vulnerability in Hugging Face Transformers (a library for working with AI models) versions 5.8.0 and earlier allows attackers to write files anywhere on a user's computer through path traversal (a technique where an attacker uses special characters like '../' to escape the intended directory). The flaw exists in the `save_pretrained()` methods, which don't properly validate dictionary keys before using them as filenames, allowing attackers to distribute malicious model configuration files that execute arbitrary writes when downloaded and saved by victims.

Keras (a machine learning library) versions 3.14.0 and earlier have a vulnerability where certain functions bypass safety checks and automatically follow ExternalLinks (references to files outside the main file) in HDF5 files (a format for storing large scientific data). An attacker can create a malicious Keras model file that tricks the library into reading sensitive data from anywhere on a victim's computer and either extracting it or loading it into the user's model.

The http_request tool in Strands Agents (an SDK for building AI agents) has an authorization flaw where an attacker could trick the LLM into routing requests through a malicious proxy server. Even though the tool checks that requests only go to approved hostnames, an attacker using indirect prompt injection (hiding instructions in untrusted web content the agent reads) could bypass this by controlling the proxies parameter, causing sensitive credentials to be sent in cleartext to their server.