Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md and ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE verdict with a 100/100 trust score.
CVE-2026-82293 is an Incorrect Authorization flaw (CWE-863) in the Kibana machine learning feature. An authenticated user can invoke machine learning functionality beyond their authorization scope, consuming cluster resources they should not be able to reach.
CVE-2026-78598 is an incorrect authorization flaw (CWE-863) in the Kibana machine learning feature. An authenticated user with machine learning job management privileges in a single Kibana space could make a job's saved object accessible across all spaces in the Kibana instance, without holding access rights to those other spaces.
The `ckan_get_mqa_quality` and `ckan_get_mqa_quality_details` tools in the CKAN MCP Server limit `server_url` to `dati.gov.it` using an unanchored regex in `isValidMqaServer`. URLs such as `https://dati.gov.it.attacker.com/x` and `https://dati.gov.it@attacker.com/x` pass validation, so the tools send requests to attacker-controlled hosts and return their responses to the caller.
Fix: Validate the parsed host instead of the raw string: parse the URL with `new URL()`, require the `https:` protocol, and compare `hostname` exactly against `dati.gov.it` or `www.dati.gov.it`. Anchoring the regex end-to-end (`/^https:\/\/(www\.)?dati\.gov\.it(\/|$)/i`) also closes the suffix trick, but URL parsing with exact host comparison is the robust fix and also neutralizes the `@`-userinfo variant.
Kestra OSS contains an OS command injection vulnerability (CVE-2026-49869) that allows an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. The item is listed as actively exploited in the wild (CISA KEV).
NLTK's Stanford Java wrapper classes (GenericStanfordParser, StanfordTagger, StanfordTokenizer, StanfordSegmenter) pass user-supplied java_options through the per-call options parameter of nltk/internals.py java(), which calls subprocess.Popen without _validate_java_options(). This bypasses the validation added for CVE-2026-12841, which blocks flags such as -agentpath, -javaagent, -agentlib and @argfile when set through config_java(). An attacker who controls java_options can inject these JVM flags, which the source says can achieve arbitrary code execution, and the issue is incomplete fix of CVE-2026-12841.
CVE-2026-72654 is an Execution with Unnecessary Privileges flaw (CWE-250) in the Kibana machine learning feature. An operation available to users with only read access ran under an internal service identity instead of the requesting user's identity, letting such users receive data from Elasticsearch indices they are not authorized to read. No Elasticsearch cluster or index privileges are required.
CVE-2026-72649 is a Deserialization of Untrusted Data flaw (CWE-502) in the Elasticsearch machine learning component. A specially crafted trained model artifact can lead to remote code execution via Object Injection (CAPEC-586), running attacker-controlled logic with a broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.
CVE-2026-83551 affects the HMAC configuration in the SageMaker Python SDK, which the @step and @remote decorator pipeline component uses to protect serialized function payloads stored in S3. The HMAC secret key is stored in cleartext in pipeline definitions and is readable through the DescribePipeline API, so an account actor with permission to invoke that API can extract it, forge valid payloads, and overwrite S3 objects to run code in another user's pipeline execution context within the same AWS account. Impacted versions are SageMaker Python SDK v3 before v3.11.0 and v2 before v2.256.0.
Fix: Fixed in SageMaker Python SDK v3.11.0 and v2.256.0. Consult the referenced AWS Security Bulletin 2026-093-AWS for the most up-to-date and complete information.
OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. A repository carrying an attacker-controlled .git/config, with attr.tree and a configured clean or process filter, could make Git run an attacker-controlled program outside Codex's command sandbox, with the signed-in user's privileges and no trust prompt or command approval. Exploitation requires Git on PATH and the user opening the attacker-prepared repository with its local Git configuration intact.
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.fsmonitor at an attacker-controlled filesystem-monitor helper, Git runs that helper outside Codex's command sandbox and without user approval, letting attacker code act with the user's privileges, including reading, changing, or deleting files. An ordinary Git clone does not preserve the local .git/config, so exploitation requires a repository delivered or copied with that configuration intact.
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser read the stop-parsing token (--%) differently than PowerShell does. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting approval. If filesystem protections permit the write, the attacker can modify Codex's configuration so that a later load launches an attacker-controlled MCP server, executing code with the user's privileges.
CVE-2026-19590 affects OpenAI Codex Desktop for Windows and macOS. Automated Git operations trusted the repository's local core.hooksPath setting, so an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory can make Codex run a malicious hook while processing it. The hook runs outside Codex's command sandbox, without user approval, and with the user's privileges, so it can read, change, or delete the user's files and reach other resources available to the account. An ordinary Git clone does not preserve the repository-local configuration needed for exploitation.
The mlflow.statsmodels flavor's _load_model calls statsmodels.iolib.api.load_pickle, which wraps pickle.load, without checking MLFLOW_ALLOW_PICKLE_DESERIALIZATION. An attacker who can place a crafted MLmodel artifact with a malicious model.pkl in an accessible artifact store can trigger code execution in any process calling mlflow.pyfunc.load_model() on it, even when the setting is False. Default deployments without basic-auth require no credentials to upload the artifact.
Fix: Add the missing MLFLOW_ALLOW_PICKLE_DESERIALIZATION guard to mlflow/statsmodels/__init__.py, in _load_model, raising MlflowException when pickle deserialization is not allowed.
A vulnerability in Hugging Face Transformers (versions 4.49.0, <= 5.8.1) lets remote Python files be written to local disk without user consent when GenerativePreTrainedModel.load_custom_generate() is used. The function fetches and caches attacker-controlled custom_generate/generate.py into ~/.cache/huggingface/modules before the trust_remote_code consent check, so the file persists even if the user declines the trust prompt. The write is caused by an unconditional file write in dynamic_module_utils.py.
A security flaw in Doccano, an open source annotation tool for machine learning practitioners, affects versions up to 1.8.5. The issue sits in the LabelList function of the Bulk-Delete Endpoint, reached through /v1/projects/1/category-types, and manipulating it results in improper access controls. The attack can be run remotely, and a public exploit has been released.
A vulnerability in Doccano, an open source annotation tool for machine learning practitioners and auto labeling pipelines, affects versions up to 1.8.5. The flaw is in the ExampleDetail function of the file /v1/projects/1/examples/, in the Project Example Detail Endpoint, and stems from improper access controls that can be exploited remotely. A public exploit is available and may be used, and the vendor did not respond when contacted early about the disclosure.
MCPHub, a hub for managing and orchestrating multiple MCP servers and APIs, performs no role checking on its built-in prompt and resource controllers before version 1.0.32. Any authenticated non-admin user can call the mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes, creating, overwriting or shadowing global prompt templates and resources that are served to all users. Because these records are consulted before any connected MCP server, the tampering can also lead to prompt injection in other users' LLM sessions.
Fixed in 1.0.32.
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpers) accept a model-supplied file path without a workspace-containment check. A crafted relative, absolute, or ~-expanded path can write or delete files outside the workspace with the privileges of the Theia backend OS user, and writes apply without a confirmation dialog in Agent Mode. Overwriting a host-executed file such as a shell startup file or ~/.ssh/authorized_keys can escalate to code execution on the backend.
CVE-2026-77956 is a code injection flaw in ash-project ash_ai, versions from 0.1.0 before 1.0.0. AshAi.Actions.Prompt passes prompt content through EEx.eval_string/2, so when a prompt action builds its text from request data, attacker-controlled input is compiled and run as Elixir. A remote, unauthenticated client can thus execute arbitrary Elixir code on the server, before any model request is made.
Fix: The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk and CISA's Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due date: 2026-09-05.
CISA Known Exploited Vulnerabilities