Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
praisonaiagents, in tools/spider_tools.py, has an SSRF protection bypass in _host_is_blocked(). The function checks only literal IP strings and hostname aliases and never performs DNS resolution, so any hostname resolving to a private or loopback address, such as 127.0.0.1.nip.io, passes the filter. A live exploit shows scrape_page("http://127.0.0.1.nip.io:PORT/secret") returns the response of an internal service, and scrape_page, extract_links, crawl and extract_text are registered as LLM-callable tools.
PraisonAI's workflow include implementation in praisonaiagents (Workflow._execute_include() in praisonaiagents/workflows/workflows.py) imports and executes an included recipe's tools.py even when the documented PRAISONAI_ALLOW_LOCAL_TOOLS and PRAISONAI_ALLOW_TEMPLATE_TOOLS opt-ins are unset. This bypasses the hardening added for the earlier automatic tools.py advisory family. A workflow that includes an untrusted local recipe runs arbitrary Python module-level code as the PraisonAI process user before any model call.
The praisonaiagents web_crawl tool validates only the initial URL's resolved IP against a private and loopback blocklist, then fetches with httpx.Client(follow_redirects=True) without re-validating redirect targets. A public URL that returns a 302 to an internal address, such as the cloud metadata endpoint 169.254.169.254 or 127.0.0.1 services, causes the internal response body to be returned into the agent context. The default httpx crawl provider on a standard pip install praisonaiagents is affected, and the flaw is described as an incomplete fix for earlier web_crawl SSRF reports.
CVE-2026-78684 affects vLLM before 0.27.0, which fails to classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. An unauthenticated attacker can activate DeepStream at request time, initialize the process-wide GPU decode pool, and submit video that bypasses resource controls, causing partial denial of service for concurrent requests. VulnCheck rates it CVSS 4.0 6.9 (MEDIUM); NVD has not yet provided an assessment.
NLTK before 3.10.0 (affected versions <=3.9.4) has an unsafe pickle deserialization flaw in TransitionParser.parse() (nltk/parse/transitionparser.py). The method calls pickle_load() with restricted=False, routing loads through WarningUnpickler, which does not override find_class(), so arbitrary class resolution is allowed. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application.
Fixed in 3.10.0.
The Continue CLI relies on an incomplete denylist as its only barrier to destructive shell commands in headless and auto mode, where the default policy grants the Bash tool allow permission. The critical-command check blocks only a small set of root and system paths, so recursive forced removal of directories such as /home or /root, and $HOME expansion, pass through. An indirect prompt injection in content the agent reads, such as web pages, repository files or issue text, can cause an unattended run to destroy the invoking user's data.
Xinference loads Hugging Face models with trust_remote_code unconditionally enabled, and versions before 2.12.0 provide no setting to disable it. A caller with model launch access can register a model with an arbitrary path, causing AutoTokenizer.from_pretrained to import and execute Python declared in the model's tokenizer_config.json auto_map, with the privileges of the worker process.
Fix: Fixed in 2.12.0, which gates every site behind allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting, permitting remote code only for bundled built-in models.
BentoML's outbound connection safeguard, make_safe_connect in _internal/utils/uri.py, blocks private, loopback, and link-local addresses but does not reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs in that range through MultipartSerde.ensure_file or JSONSerde.parse_request, making the server send requests to internal hosts on CGNAT networks. This is an incomplete fix for CVE-2025-54381.
Xinference used Python's eval() to parse Llama3 tool-call output in the extract_tool_calls() function of xinference/model/llm/tool_parsers/llama3_tool_parser.py. A remote, unauthenticated attacker can use prompts sent to the /v1/chat/completions endpoint to make the model return a Python expression, which the server evaluates. The flaw is rated Critical, CVSS 10.0, and allows remote code execution in the Xinference server process in the tested default deployment.
Omnigent, an open-source AI agent framework and meta-harness for orchestrating coding agents, is affected by CVE-2026-62677 in versions prior to 0.3.0. An authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value, which the parser and validator store without constraint. When OMNIGENT_RUNNER_WORKSPACE is unset, the attacker-controlled path becomes the trusted root, letting sys_os_read, write, edit and shell tools reach runner files and environment secrets outside the intended workspace.
Fixed in 0.3.0.
Omnigent, an open-source AI agent framework and meta-harness for orchestrating coding agents, has a flaw in its shared shell-command parser (omnigent/policies/builtins/_shell.py) before version 0.3.0. The parser does not recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, or a single background control operator. A gated git push or gh write hidden in these forms yields no parsed operation, so the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace (CVE-2026-62676).
CVE-2026-62675 affects Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0. An authenticated user can submit an agent bundle to POST /v1/sessions, and validate_agent_bundle in omnigent/server/bundles.py fails to reject a tools..callable dotted Python path, so the bundle can select subprocess.check_output and run a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access.
Fixed in 0.3.0.
CVE-2026-62674 affects Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0. The PUT /sessions/{session_id}/agent endpoint checks LEVEL_EDIT permission but does not reject a bound shared or template agent whose agent.session_id is None. An authenticated user with edit access to a session can replace that shared agent bundle, add a stdio MCP server, and cause later sessions using the shared agent to run an attacker-controlled command with the Omnigent runner's permissions, exposing files, credentials, workspace data, internal services, and runner availability.
In ONNX before 1.21.0, the save_external_data function opens the external-data file path for writing without O_NOFOLLOW or O_EXCL, after a non-atomic os.path.isfile() check. A local attacker with write access to the directory where a victim serializes external data can pre-plant a symlink that gets followed, so the victim's write appends to any file the victim can write, such as ~/.ssh/authorized_keys, cron files, or application configs.
Fix: Fixed in 1.21.0.
SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies restrict_to_same_domain only to leaf url entries, not to nested sitemap entries, which are passed directly to self.scrape_all([loc.text], "xml") and fetched with an aiohttp GET. An attacker who controls or influences an ingested sitemap can point a nested entry at an internal address, so the server fetches it even when restrict_to_same_domain is True, and the response is returned in the Documents.
CVE-2026-69855 is a server-side request forgery (SSRF) flaw in Microsoft Copilot in Azure, classified as CWE-918. An authorized attacker can exploit it over a network to disclose information. The source gives no CVSS score, as NVD has not yet provided an assessment.
A NoSQL injection flaw in langgraph-checkpoint-mongodb and langgraph-store-mongodb lets a caller who controls the filter argument embed MongoDB query operators, because keys prefixed with $ are not rejected. The affected methods are MongoDBSaver.list(), MongoDBSaver.alist() and MongoDBStore.search(), and the advisory rates the issue High (CVSS 4.0 base 7.1, CVSS 3.1 base 7.7), with cross-tenant read exposure of checkpoint data.
Upgrade langgraph-checkpoint-mongodb to 0.3.0 or later and langgraph-store-mongodb to 0.4.0 or later. If an upgrade is not possible immediately, remove or escape MongoDB query metacharacters such as "$" from user-controlled input before passing it to the filter parameter.
CVE-2026-15679 is a remote code execution flaw in Hugging Face PyTorch Image Models. The flaw lies in checkpoint parsing, where user-supplied data is not properly validated, leading to deserialization of untrusted data. Remote attackers can execute arbitrary code in the context of the current process, but the target must visit a malicious page or open a malicious file.
CVE-2026-18482 is a command injection vulnerability in the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server in Neo.mjs. The checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS command execution when an AI agent is induced to invoke these tools.
Fix: Commit 88c77fc fixes these vulnerabilities.
NVD/CVE DatabaseThe AI Agent by SiteGround plugin for WordPress contains an authorization bypass in all versions up to and including 1.2.7. The plugin does not verify that a user is authorized to perform an action, so unauthenticated attackers can upload images to the WordPress media library. This bypasses the upload_files capability that normally restricts Contributors. The sg_ai_studio_gutenberg_nonce required by the endpoint is issued to any user with block editor access, so the missing upload_files check is the only remaining barrier.
Fix: Fixed in version 0.3.0.
NVD/CVE DatabaseFix: Fixed in version 0.3.0.