AI & LLM Vulnerabilities

The Bedrock AgentCore Python SDK (a library for building AI agents on Amazon's platform) has a vulnerability where OpenTelemetry spans (data that tracks what a program is doing) were writing unfiltered user prompts and AI responses to CloudWatch logs (AWS's logging service). This meant that anyone with read access to those logs could see potentially sensitive information. The vulnerability affects versions 1.4.8 and 1.5.0.

Kiota, a tool that generates HTTP client code from API descriptions, had a security flaw in versions before 1.32.5 where it didn't properly validate file paths when creating plugin files. This allowed attackers to include specially crafted file paths that could access files outside the intended directory (path traversal, where attackers use ../ to escape folders) or include files from unexpected locations when the generated plugin was deployed.

django-haystack's Elasticsearch backend contains a remote code execution vulnerability where it calls `eval()` (a function that executes Python code from strings) on field values without proper validation. This happens when a SearchField uses an `index_fieldname` alias different from its logical name; the lookup fails and the raw value is passed to `eval()`. An attacker who can control indexed content and trigger a search can execute arbitrary code on the Django application.

LiteLLM version 1.18.10 has a remote code execution vulnerability in its MCP server creation feature, where the application accepts JSON configuration files with arbitrary command and args values and executes them without checking if they're safe, allowing attackers to run unauthorized operating system commands with the privileges of the LiteLLM process.

The Obsidian Local REST API plugin has a path traversal vulnerability (a flaw where attackers can access files outside the intended directory) in its `/vault/{path}` endpoints. An authenticated attacker can bypass path validation by using URL-encoded characters like `%2F` (encoded forward slash) and `%2e%2e` (encoded dots), which aren't blocked during initial routing but get decoded later, allowing them to read, write, or delete arbitrary files on the host system with the privileges of the Obsidian process.

ncnn is a framework that runs AI neural networks efficiently on mobile devices. A vulnerability exists where loading a malicious model file can cause an out-of-bounds heap write (writing data to memory locations outside the intended array), because the code only checks if a parameter ID is too large, but doesn't prevent negative IDs from accessing memory before the array.

Strands Agents, a Python SDK for building AI agents, contained a vulnerability (CVE-2026-15746) in its elasticsearch_memory tool where connection settings could be controlled by the LLM (the AI model itself). If an API key wasn't provided, the tool would use the operator's Elasticsearch API key from their environment and send it to any server the LLM directed it to, allowing attackers to steal credentials through a crafted prompt.

PyTorch Lightning (a framework for training AI models) versions up to 2.6.5 contain a remote code execution vulnerability (a security flaw that lets attackers run their own code on your computer) in the _load_state function. Attackers can create malicious checkpoint files (saved model data) that bypass security protections and execute harmful code when you load a model using LightningModule.load_from_checkpoint.

Authenticated users of LangBot can run any command they want on the server by adding a malicious STDIO MCP (a plugin system that executes external programs) through the Extensions settings. An attacker who logs in (either through their own account or stolen credentials) can configure the MCP to run arbitrary commands, giving them complete control over the machine.

NVIDIA TensorRT-LLM for Linux has a vulnerability in its unpickler (a tool that converts serialized data back into usable objects) that allows local attackers to deserialize untrusted data. A successful attack could lead to code execution, privilege escalation, data tampering, and information disclosure.

CVE-2026-47482 is a memory leak vulnerability (a bug where a program fails to free up memory it's no longer using) in NVIDIA Triton Inference Server for Linux that allows attackers to cause a denial of service (making a service unavailable to legitimate users). The vulnerability stems from the software not properly releasing memory after it's finished using it.

CVE-2026-47480 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows an attacker to trigger an uncaught exception (an error that the program doesn't handle properly), potentially causing a denial of service (making the service unavailable to legitimate users). The vulnerability has a CVSS 4.0 severity rating, though a detailed assessment has not yet been provided.