AI & LLM Vulnerabilities

PraisonAI versions before 4.6.78 have a security misconfiguration in their prompt injection defense (a security feature that blocks attempts to trick an AI into ignoring its instructions). The defense is set to only block attacks marked as CRITICAL severity, which means HIGH-severity attacks slip through without being blocked, allowing attackers to extract hidden system prompts and trigger unauthorized tool use.

The mcp-atlassian tool's `confluence_upload_attachment` function has a critical vulnerability where it reads files from any path without validation, allowing authenticated users or AI agents tricked via prompt injection (hidden malicious instructions in text input) to steal sensitive files like SSH keys and environment variables containing API credentials. Attackers can exploit this by manipulating an AI agent to upload protected files to Confluence, or by directly calling the vulnerable function if they have MCP (model context protocol, a tool-calling interface) access.

BabelDOC's PDF parser has a critical vulnerability where it deserializes untrusted pickle data from CMap files without proper path validation. An attacker can craft a malicious PDF with a specially encoded filename in the `/Encoding` name field (e.g., `/#2Ftmp#2Fattacker#2Fevil`, which decodes to `/tmp/attacker/evil`) that tricks the path-joining logic into loading an attacker-controlled pickle file instead of a trusted one, leading to arbitrary code execution (running attacker code with the program's permissions).

n8n is an open source workflow automation platform (software that helps connect different apps and services together). In versions before 2.27.4 and 2.28.1, the AI Agents feature had a security flaw where it didn't properly check domain restrictions on credentials (login information), allowing a member-level user with limited access to send secret credentials to an external server they control.

The soupsieve library (a CSS selector engine used by Beautiful Soup 4) contains a ReDoS vulnerability (regular expression denial of service, where a maliciously crafted input causes the regex engine to hang by repeatedly backtracking). When the CSS parser encounters an unterminated quoted attribute selector like `[a="xxxx...`, the regex pattern enters catastrophic backtracking, and just 300 bytes of input can cause the parser to hang for over 3 seconds, freezing any application that uses soupsieve.compile() or Beautiful Soup's .select() methods with untrusted input.

Soupsieve (the CSS selector engine for Beautiful Soup 4) has a memory exhaustion vulnerability where the CSS parser allocates unbounded memory when compiling large comma-separated selector lists. An attacker can supply a crafted CSS selector string to `soupsieve.compile()` or Beautiful Soup's `.select()` method to cause the application to allocate hundreds of megabytes of memory from a small input, leading to denial of service (making the application unavailable by consuming all available memory).

Phantom version 1.3.0 and earlier had two security flaws: AI agents could write files anywhere on a developer's computer (including files that run code when the system starts), and the audio processing tools could be crashed by tricking them into expanding tiny compressed files into huge amounts of data. Both issues are caused by missing safety checks on file paths and audio input sizes.

Stanza, a Stanford library for processing human language in Python, had a vulnerability where loading malicious model files could allow attackers to run arbitrary code on a user's computer. The problem occurred because the library would try a secure loading method first, but if that failed, it would fall back to an unsafe method that could execute malicious instructions hidden in pickle (a Python format for storing data).

Serena, an AI agent framework, runs an unauthenticated Flask web dashboard on a fixed port (24282) with no login protection or security checks. An attacker can use DNS rebinding (a technique where an attacker controls a domain and redirects it to a victim's local machine) to write malicious commands into Serena's memory from a malicious webpage, which the agent then executes using `shell=True` (a mode that allows shell code injection). This creates a complete remote code execution vulnerability that requires only visiting a malicious website while Serena is running.