AI & LLM Vulnerabilities

Hatchet is a platform for running background tasks and AI workflows. Before version 0.91.1, it had a security flaw where the OAuth state validation (a security check that confirms login requests are legitimate) could be bypassed by an attacker, allowing them to connect a victim's account to an attacker's login credentials if certain OAuth providers like Google or GitHub were enabled.

Feast, an open source tool for storing features (data used to train AI models), had a security flaw in versions before 0.65.0 in its GitHub workflow configuration. The flaw allowed a contributor from a forked repository to run their modified code with access to sensitive credentials (authentication tokens for GCP, AWS, and Snowflake cloud services), potentially letting them steal those credentials or access cloud resources they shouldn't reach.

Mistral Vibe before version 2.25.5 has a remote code execution vulnerability (RCE, where an attacker can run commands on a system they don't own) in its worktree creation process. The vulnerability occurs because git hooks (scripts that run automatically during git operations) are executed before the system checks whether the repository is trusted, allowing attackers to run malicious commands with the same user privileges as Vibe.

ToolHive's containerized MCP servers (which are Docker containers running AI tools) can reach host services through `host.docker.internal` (a special hostname that points to the host machine from inside a container) when using the default insecure network settings, allowing a compromised server to attack other services on the host without breaking out of the container. This is especially dangerous because ToolHive's MCP endpoints and other MCP servers are unauthenticated (don't require login), so an attacker can call their tools directly.

LMDeploy (a tool for deploying large language models) has a critical vulnerability in how it loads model configurations from HuggingFace. When loading a model, the software uses eval() (a Python function that executes code from text) on an untrusted value called quant_dtype without checking if it's safe. An attacker can publish a malicious model on HuggingFace with crafted code hidden in the quant_dtype field, allowing them to run arbitrary commands on any computer that loads the model using LMDeploy.

vLLM (a tool for running large language models) versions before 0.28.0 have a vulnerability where two endpoints (/v1/embeddings and /pooling) don't properly check if token IDs (numeric identifiers representing words) are valid. An attacker can send a request with a negative token ID to crash the system, and because this triggers a CUDA assertion (an error check on the GPU, the specialized processor used for AI), it corrupts the GPU's state and breaks all future requests until the service restarts.

A flaw in Microsoft 365 Copilot's permission settings allows someone with authorized access to improperly view sensitive information across a network. The issue stems from incorrect assignment of permissions (access rules) to a critical resource (important data or system component), meaning the AI tool isn't properly restricting who can see what.

vLLM (a software framework for running large language models) versions up to 0.29.0 has a memory cleanup bug in its decode workers (specialized processors that handle the generation phase of AI inference). Attackers can exploit this by sending requests with max_tokens=0 (asking for zero output tokens), which prevents the system from properly clearing temporary data, eventually consuming all available memory until the worker crashes and restarts.