Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
NVIDIA Triton Inference Server for Linux contains an absolute path traversal vulnerability, tracked as CWE-36. A successful exploit might lead to code execution and information disclosure. NVD has not yet provided an assessment.
Context7 through version 2.1.2 contains a prompt injection flaw in its Custom AI Instructions feature, served through the MCP server. An attacker can inject unsanitized content into those instructions, which connected AI coding agents then execute. The poisoned instructions can exfiltrate credentials from environment files to an attacker-controlled service and delete files on the victim's machine when the agent makes a routine library documentation request.
The Apify MCP server, prior to version 0.10.11, builds the Actor MCP server URL in getActorMCPServerURL (src/mcp/actors.ts) by concatenating the trusted Actor standby URL with the attacker-controlled webServerMcpPath from an Actor definition, without checking the resulting origin. A malicious Actor publisher can use a userinfo-style authority value to redirect connectMCPClient to a third-party host. The call-actor, fetch-actor-details, and actor-mcp paths then send the victim's Authorization bearer token, exposing the Apify API token and granting access to Actors, stored data, and billable compute. Exploitation requires that a victim invoke or inspect the attacker-controlled Actor.
CodeWhale (codewhale and codewhale-tui) versions 0.8.41 up to but not including 0.8.64 contain an argument injection flaw in the git_show tool. The model-supplied rev parameter reaches the git show argv without an --end-of-options sentinel, so a value starting with --output= is read as a git flag, enabling arbitrary file writes as the invoking user, since the tool is auto-approved and advertised as read-only.
Fix: Fixed in 0.8.64 by adding rev validation.
CodeWhale (packages codewhale and codewhale-tui), versions >= 0.8.41 and < 0.8.64, contains a remote code execution flaw in the rlm_eval tool. Its approval_requirement() returns ApprovalRequirement::Auto, so the engine never prompts and runs model-supplied Python in a python3 interpreter without consulting --approval-policy. An attacker can trigger this through prompt injection in untrusted content the agent reads, such as a web page, fetched URL, repository file or MCP tool result, with the companion rlm_open tool able to stage that content. Code runs at the user's privilege level.
CVE-2026-63632 affects the Open Neural Network Exchange (ONNX) library from 1.3.0 through 1.22.0. When a Gemm node has input tensors with fewer than two dimensions, onnx.version_converter.convert_version() reads out of bounds in Gemm_7_6::adapt_gemm_7_6() during an opset 7 to 6 downgrade, because B_shape[1], A_shape[0], or A_shape[1] is accessed without a rank check. The result is potentially a process crash.
Fix: Fixed in version 1.22.0.
CVE-2026-24301, filed under CWE-77, is an improper neutralization of special elements in a command in Microsoft Copilot. Per the source, an unauthorized attacker can disclose information over a network. NVD had not yet provided an assessment at publication, which was 08/18/2026.
CVE-2026-75093 is a vulnerability in sonos tract up to 0.23.4, in the function Tensor::from_raw_dt_align in data/src/tensor.rs of the ONNX Initializer Loader component. Manipulation there leads to incorrect calculation of buffer size, classified as CWE-120 and CWE-131. The attack may be launched remotely, and the exploit has been disclosed publicly and may be used.
Fix: It is best practice to apply a patch to resolve this issue. The patch is 66b10bda8895f4bfaf8c205361f0125cdf51f99b.
CVE-2026-75090 affects EricLBuehler Mistral.rs up to 0.8.22, specifically the convert_gguf_to_hf_tokenizer function in mistralrs-core/src/gguf/gguf_tokenizer.rs within the GGUF Tokenizer component. Manipulating the eos_token_id, bos_token_id or unknown_token_id argument causes an out-of-bounds read. The attack can be executed remotely, and a public exploit is now available.
Fix: Upgrade to version 0.8.23. The patch is identified as cd5297e2ea5cb27c790bdcf2f3c2f1064a81d55e.
The `_validate_source_run` and `_validate_source_model` functions in `mlflow/server/handlers.py` confirm only that a model version source lies within a run's artifact directory, without checking the caller's READ permission on that run. An authenticated user can reference another user's `run_id` in `CreateModelVersion`, then read that user's artifacts through `GET /model-versions/get-artifact`, bypassing the experiment-level READ gate on `GET /get-artifact`. The bypass matters where `default_permission` is `NO_PERMISSIONS` or the target experiment grants the attacker no access.
When MLflow runs with the built-in basic-auth plugin (`--app-name basic-auth`), any authenticated user can write dataset records into another user's run through `POST /api/2.0/mlflow/runs/log-inputs`. The `LogInputs` handler is missing from the `BEFORE_REQUEST_HANDLERS` map in `mlflow/server/auth/__init__.py`, so the authorization check is skipped, while other run-write endpoints such as `log-metric` correctly return HTTP 403. The source's proof of concept uses MLflow v3.13.0, and it shows that injected dataset entries persist and corrupt dataset lineage metadata.
The unauthenticated webhook test endpoint in the default MLflow Tracking Server (`POST /api/2.0/mlflow/webhooks/{id}/test`) returns the upstream response status and body to the caller. The SSRF guard `_validate_webhook_url`, added in PR #20747 and shipped in 3.10.0, checks only the original hostname, and delivery follows HTTP redirects without re-validation or IP pinning, so an allow-listed HTTPS host can redirect to internal or metadata addresses and the response is reflected back, yielding unauthenticated full-read SSRF on a default server.
The HTTP MCP server-registry backend, `atomic_agents/mcp_registry/http.py` (`make_http_mcp_server_registry_backend_from_url`), accepts both `http` and `https` catalog URLs, affecting all versions through 1.0.0. Catalog `command`/`args` values are type-validated but not content-restricted, and `MCPClientPool` spawns them as local stdio subprocesses. Over a cleartext `http://` catalog, a network man-in-the-middle can rewrite the response to inject arbitrary commands and gain code execution on the agent host without LLM involvement. The `https` path is stated to be sound, and `mcp_allow_fn` defaults to None, so no allowlist applies unless an operator configures one.
MemOS, a memory operating system for LLMs and AI agents, has an authentication bypass when AUTH_ENABLED=true but the INTERNAL_SERVICE_SECRET environment variable is unset. The is_internal_request() check in src/memos/api/middleware/auth.py then compares None to None, which evaluates true, so an unauthenticated remote attacker is treated as an internal principal with scopes ["all"]. This grants access to admin API-key management endpoints (minting, enumerating, revoking keys, and generating a master key) and to all data endpoints.
CVE-2026-75104 affects Hugging Face Transformers, which fails to validate shard filenames in checkpoint index files. A malicious index file containing parent-directory references or absolute paths is joined without validation, letting an attacker read arbitrary files outside the model directory. The source rates it CVSS 4.0 6.8 MEDIUM from VulnCheck, with NIST's assessment not yet provided.
vLLM, an inference and serving engine for large language models, is affected prior to version 0.26.0. The MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get and Image.open instead of MediaConnector, which bypasses the allowed_media_domains and allowed_local_media_path protections. This allows server-side requests and reads of arbitrary files accessible to the vLLM process.
vLLM versions prior to 0.26.0 expose the /v1/completions/derender and /v1/chat/completions/derender endpoints, which accept caller-supplied GenerateResponse objects. The OnlineDerenderer and tokenizer.decode process these structures before max_model_len, max_tokens, max_num_seqs, or response-size limits are enforced, so an authenticated API client can consume excessive CPU and memory and produce oversized responses.
Fix: Fixed in 0.26.0.
CVE-2026-64859 affects New API, a large language model (LLM) gateway and asset management system, prior to 1.0.0-rc.7. The admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token, so an authenticated administrator can obtain the root user's bearer token and access root-only system configuration APIs. The weakness is classified as CWE-200.
Fix: Fixed in version 1.0.0-rc.7.
UpTrain versions 0.7.1 and prior are affected by a remote code execution flaw in the /new_run endpoint, reachable through the checks and metadata parameters. Any user with access to UpTrain and a valid authentication method may be able to run arbitrary code in the context of the host, which in most cases is the docker container suggested by the documentation.
UpTrain versions 0.7.1 and prior have a remote code execution flaw in the `/add_prompts` endpoint, reachable through the `checks` and `metadata` parameters. Any user with UpTrain access and a valid authentication method may execute arbitrary code in the context of the host running UpTrain, which in most cases is the Docker container suggested by the documentation.
Fix: Fixed in 0.10.11.
NVD/CVE DatabaseFix: Fixed in 0.8.64.
Fix: Require `https` by default and gate `http://` behind a loud explicit opt-in. Defense-in-depth: allowlist the resolved command basename (or require confirmation) before any registry-sourced subprocess spawn. Document the consequence in spec/36.
Fix: Fixed in version 0.26.0.