Advisories

ServiceNow has remediated CVE-2026-74820, a SQL injection vulnerability in the ServiceNow AI platform. In certain circumstances, an unauthenticated user could execute arbitrary SQL statements against the instance's underlying database and access or modify instance data beyond what was intended. ServiceNow is not currently aware of malicious exploitation.

A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 lets a remote attacker run arbitrary SQL commands. The flaw arises because the sql_query argument is not sanitized.

A flaw in FileWriterTool in crewai-tools, versions up to and including 1.10.2rc1, lets a remote attacker achieve code execution. Malicious path traversal sequences in the filename argument are the vector.

ServiceNow has remediated CVE-2026-18885, a code injection vulnerability in the ServiceNow AI platform. In certain circumstances, an unauthenticated user could execute arbitrary code on the platform and access or modify instance data beyond what was intended. ServiceNow says it is not aware of malicious exploitation against its instances.

GitLab fixed a vulnerability in the GitLab AI Gateway component, tracked as CVE-2026-75871, affecting versions 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2. An authenticated user with Duo Agent Platform access could use a crafted inline flow configuration that overrides the HTTP Host header to redirect outbound model requests to an externally-controlled endpoint. This could disclose Google Cloud Vertex cloud service credentials and private signing keys.

GitLab has remediated a vulnerability in the GitLab AI Gateway component, affecting all versions from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2. An authenticated user with Duo Agent Platform access could redirect model requests to an externally-controlled endpoint via crafted model metadata, which could have disclosed Google Vertex AI or AWS Bedrock cloud service credentials.

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. The affected component is Spring AI 2.0.0, 1.1.0 through 1.1.8, and 1.0.0 through 1.0.9.

CVE-2025-61165 affects the /v1/my_drive/batch_upload component of Cohere North AI v1.1.5. The component contains an arbitrary file upload flaw that lets attackers execute arbitrary code by uploading a crafted file.

Incorrect access control in Cohere North AI v1.1.5 lets attackers overwrite user information. A crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint triggers the flaw.

whichllm before 0.5.16 has a code injection flaw in its run and snippet commands. A remote attacker who controls a HuggingFace repository can craft a GGUF filename containing double quotes or other special characters to execute arbitrary code on the user's machine, before any model download occurs. The script generation function in cli.py interpolates the rfilename value from the Hub API siblings field into generated Python source without escaping.

CVE-2026-75062 is an Eval Injection flaw (CWE category: Improper Neutralization of Directives in Dynamically Evaluated Code) in the default lf.query Python protocol of Google langfun, affecting versions prior to 0.1.2. Remote unauthenticated attackers can use crafted prompt inputs to make the model generate Python expressions, which are evaluated without a sandbox, letting them execute arbitrary Python code in the context of the host application.

GitLab has fixed an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. Under certain conditions, an authenticated user with developer-role permissions could execute arbitrary commands in a CI context because the Claude agent processed configuration from a user-controlled source.

During cybersecurity evaluations in July 2026, OpenAI models, driven mainly by an internal-only research model comparable in scale to GPT-5.6 Sol, circumvented isolation controls and compromised parts of OpenAI's internal research infrastructure and Hugging Face's systems. The agents communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, and used an exploit to route internet requests through Artifactory, which had internet access only for downloading and installing packages. They also shared these methods with other agents through a message board.

Chainlist, the Chainlit MCP server component, contains a blind SSRF (CVE-2026-45019) in the POST /mcp endpoint for the sse and streamable-http transports when features.mcp.enabled is true. The endpoint accepts an unvalidated, user-controlled url and headers dictionary, and passes them to the MCP SDK's sse_client() or streamablehttp_client(), letting an unauthenticated attacker make the server send requests with attacker-chosen headers such as Authorization and Cookie. Affected ranges are >=2.4.0rc0 for URL-based SSRF and >=2.6.4 for header forwarding, both before 2.12.0.