Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
mem0 (a software tool) has a critical security flaw where API endpoints lack authentication (verification of user identity), allowing attackers to steal LLM API keys (credentials used to access AI services) stored in plaintext, and exploit SSRF attacks (server-side request forgery, where an attacker tricks a server into making requests to unintended internal systems) by controlling the ollama_base_url parameter. The vulnerability has a CVSS score of 9.2, indicating it is extremely severe.
A security flaw in @better-auth/oauth-provider allows two token requests sent at the same time to both redeem a single authorization code (a temporary token that should only work once), bypassing OAuth security rules. The vulnerability affects versions 1.6.0 through 1.6.10, and similar issues exist in the legacy plugins from better-auth versions 1.4.8-beta.7 through 1.6.0.
9Router versions before 0.4.44 have a critical vulnerability where an unauthenticated attacker can execute arbitrary OS commands through the /api/tunnel/tailscale-install endpoint. The vulnerability exists because the sudoPassword field from user input is passed directly to a shell command without proper validation, and the endpoint lacks authorization checks (middleware matcher protection). An attacker can exploit this when sudo doesn't prompt for a password, such as when the process runs as root or NOPASSWD is configured.
ONNX has a null pointer dereference (a crash caused by accessing invalid memory) in its version converter when processing Upsample nodes that have zero inputs. The converter checks that required attributes exist but fails to verify that the node actually has inputs before trying to access them, causing a crash (SIGSEGV) when converting models from opset version 6 to 7.
Langroid's Neo4jChatAgent passes Cypher queries (the query language for Neo4j databases) directly from the LLM to the database without checking them first, allowing attackers to inject malicious instructions through prompt injection (tricking the AI by hiding commands in its input). This can lead to data theft, deletion, or remote code execution if certain server features are enabled, and mirrors a similar bug in SQLChatAgent that was already fixed in version 0.63.0.
9Router (a Next.js dashboard for routing AI requests) contains multiple critical vulnerabilities in versions 0.4.41 and earlier. The `/api/providers` endpoints lack authentication, allowing anyone to create, modify, or delete AI provider connections, while `/api/usage/stats` exposes full API keys (secret credentials used to access AI services) in plaintext, and `/api/usage/request-details` leaks other users' complete conversation histories without requiring a password or login.
vLLM, a system that runs large language models efficiently, has a vulnerability in versions before 0.24.0 where users can submit malicious regular expressions (patterns used to match text) through the structured_outputs.regex parameter that cause the system to hang indefinitely, making it unavailable to other users. The vulnerability exists because the regex patterns are sent directly to backend compilers without checking if they will take too long to process, and patterns with nested quantifiers (like repeated matching operations inside each other) can cause exponential state-space expansion (the number of possible states the regex checker must evaluate grows exponentially). An attacker could exploit this to perform a denial-of-service attack (making a service unavailable to legitimate users).
vLLM is a library for running and serving large language models (LLMs, AI systems that generate text). Versions 0.12.0 through 0.23.x have a bug where sending certain specially crafted requests to the /v1/completions endpoint (an API route for generating text) with models using M-RoPE (a rotary position embedding technique) causes the server to crash and stop working entirely, and any authorized user can trigger this crash.
vLLM (a system for running LLMs efficiently) versions before 0.24.0 have a bug where certain requests can cause the rejection sampler (a component that filters generated tokens) to produce an invalid token value that crashes the engine's GPU worker. Because these requests can be sent remotely through public endpoints, an attacker can trigger this crash to shut down the service for all users until the worker restarts, creating a denial of service attack (making a service unavailable to legitimate users).
Coder's AgentLogLine dashboard component failed to escape HTML characters before displaying workspace agent logs, allowing a workspace owner to inject arbitrary HTML that would render in other users' browsers when they viewed the workspace page. While a Content Security Policy blocked inline scripts, attackers could still inject redirects or CSS-based attacks.
Coder's AI Bridge Proxy had a security flaw where it disabled TLS certificate verification (the process that confirms a server's identity over encrypted connections) in its default configuration, meaning it would accept any certificate from the Coder server. An attacker positioned between the proxy and server could intercept sensitive data like session tokens and API keys. This only affects systems where the proxy and server are on separate machines; co-located systems using loopback connections are unaffected.
A security flaw in Coder's AI Bridge (a proxy for accessing LLM services) allowed suspended users to keep using their existing API keys (authentication tokens) because the system didn't check if an account was suspended, only if the key itself was valid. This meant a suspended user could continue making expensive AI requests until their token expired, which could be months later.
Coder's AI Bridge provider endpoints had a vulnerability where they read incoming request bodies without limiting their size, allowing an authenticated user to send extremely large requests that consume all available memory and crash the system (denial of service, a type of attack that makes a service unavailable). This vulnerability only affects versions 2.33 and 2.34 and requires the attacker to already have authenticated access to the AI Bridge feature.
The `coder open app` command (a tool that opens external applications linked to workspaces) was vulnerable to leaking session tokens (secret credentials that prove a user's identity) to attacker-controlled websites. When a workspace's external app URL contained a `$SESSION_TOKEN` placeholder, the command would replace it with the real token before opening the URL, potentially sending it to an attacker's server if they controlled the workspace's app definitions. This could allow an attacker to impersonate the user and access their account.
A vulnerability in Coder's file upload feature allows an authenticated user to crash the service by uploading a specially crafted zip file containing many highly compressed entries that consume excessive memory during decompression. The zip file stays under the 100 MiB upload limit, but when decompressed in memory, it exhausts available memory and causes a denial of service (making the service unavailable), though it cannot leak data or execute code.
Coder's workspace app routing trusts an unauthenticated HTTP header called X-Forwarded-Host (a header that tells the server what hostname the request came for) without verifying it came from a trusted source. An attacker can set this header in their browser to trick the server into routing requests to a victim's private app while still using the victim's authentication cookies (session identifiers), allowing the attacker to read data from that private app. This only works if subdomain app routing (using wildcard hostnames to serve multiple apps) is enabled and the upstream proxy doesn't remove this header.
Coder's tailnet coordinator (the server managing a private network) didn't validate that `AllowedIPs` (IP address ranges an agent claims to serve) matched the agent's identity, even though it did validate the agent's regular addresses. This let a malicious authenticated agent claim another agent's IP address and intercept traffic meant for that agent, such as web terminal sessions. Exploiting this required an authenticated user with a modified agent binary.
A vulnerability in Coder's workspace app system allows attackers with template authorship or external provisioner access to redirect another user's app traffic to their own workspace. The flaw occurs because the system doesn't properly verify that an app ID belongs to the correct workspace before rebinding it to a different agent (the component that handles connections). App IDs are publicly discoverable, making this attack feasible for privileged users.
A bug in Coder's file upload system allowed authenticated users to cause a denial of service (making a service unavailable) by sending a message with an extremely large declared file size, which the system would try to allocate into memory without checking if it was reasonable. An attacker could crash the entire Coder deployment with a single small message.
Coder's `coder config-ssh` command didn't properly check server-supplied SSH settings (HostnameSuffix, SSHConfigOptions) before writing them to the user's SSH configuration file, allowing a malicious or compromised server to inject arbitrary SSH configuration directives. An attacker controlling the server could inject commands like ProxyCommand to execute arbitrary code on a developer's workstation with that user's privileges.
Fix: Upgrade to @better-auth/oauth-provider@1.6.11 or later, or upgrade better-auth to 1.6.11 or later if using the legacy plugin paths. The fix replaces the unsafe find-then-delete sequence with an atomic claim-and-return primitive (consumeVerificationValue) that ensures only the first request successfully claims the authorization code, causing concurrent requests to receive an invalid_grant error instead.
GitHub Advisory DatabaseFix: Update 9Router to version 0.4.44 or later.
NVD/CVE DatabaseFix: All affected adapters, including the Upsample_6_7 adapter, have been fixed in PR #7813. A full audit of all ~45 adapters identified eight adapters with the same unguarded indexed access vulnerability (cast_9_8, softmax_12_13, softmax_13_12, upsample_6_7, upsample_9_10, group_normalization_20_21, broadcast_forward_compatibility, upsample_9_8), and all have been corrected.
GitHub Advisory DatabaseFix: Update vLLM to version 0.24.0 or later, where this issue is fixed.
NVD/CVE DatabaseFix: This issue is fixed in version 0.24.0. Users should upgrade to vLLM version 0.24.0 or later.
NVD/CVE DatabaseFix: Update to vLLM version 0.24.0 or later, where this issue is fixed.
NVD/CVE DatabaseFix: The fix enables `escapeXML: true` in the `ansi-to-html` conversion so HTML metacharacters are escaped before being inserted into the page. Patched versions are available: v2.34.2, v2.33.8, v2.32.7, and v2.29.17 (ESR).
GitHub Advisory DatabaseFix: Apply the secure transport (TLS 1.2 or higher using system root CAs) unconditionally. Patched versions are available: v2.34.2 (for release line 2.34), v2.33.8 (for release line 2.33), and v2.32.7 (for release line 2.32). As a workaround, ensure the Coder access URL uses a trusted certificate and secure the network path between the AI Bridge Proxy and the Coder server, for example through loopback or mTLS (mutual TLS, where both sides verify each other's identity).
GitHub Advisory DatabaseFix: The fix is available in patched versions: v2.34.2, v2.33.8, and v2.32.7. As a workaround before updating, administrators can immediately delete a suspended user's API keys by calling `DELETE /api/v2/users/{user}/keys` to revoke their access.
GitHub Advisory DatabaseFix: The fix applies `http.MaxBytesReader` (a setting that caps the maximum size of incoming request data) or an equivalent limit before reading request bodies. Update to v2.34.2 or v2.33.8 depending on your release line.
GitHub Advisory DatabaseFix: Update Coder to a patched version: v2.34.2 (for release line 2.34), v2.33.8 (for 2.33), v2.32.7 (for 2.32), or v2.29.17 (for 2.29 ESR). The fix applies a URL-scheme allowlist (a list of approved website protocols) in the CLI and limits session token substitution to trusted destinations like the web frontend. As a workaround, avoid running `coder open app` for untrusted workspaces.
GitHub Advisory DatabaseFix: Update to a patched version: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 depending on your release line. The fix adds a preflight check that sums projected entry sizes before decompression and enforces an aggregate size limit during the decompression process. Alternatively, restrict file-upload permissions to trusted users only, or place a reverse proxy with request-body size limits in front of the Coder server.
GitHub Advisory DatabaseFix: Update to a patched version: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (for the extended support release). The fix makes the server trust X-Forwarded-Host only from configured trusted proxies and otherwise uses the verified request host for routing. As a temporary workaround if you cannot update immediately, place an upstream reverse proxy (a server that sits in front of Coder) that strips or overwrites the X-Forwarded-Host header on untrusted requests.
GitHub Advisory DatabaseFix: Upgrade to a patched version: v2.34.2 (for release line 2.34), v2.33.8 (for 2.33), v2.32.7 (for 2.32), or v2.29.17 (for ESR 2.29). The fix validates each `AllowedIPs` prefix against the authenticating agent's UUID, matching how `Addresses` are already validated. If you cannot upgrade immediately, monitor coordinator logs for agents advertising unexpected `AllowedIPs` prefixes.
GitHub Advisory DatabaseFix: Upgrade to a patched version: v2.34.2 (for release line 2.34), v2.33.8 (for 2.33), v2.32.7 (for 2.32), or v2.29.17 (for the ESR line 2.29). The patch adds verification to ensure that existing workspace app rows belong to the workspace being built and rejects attempts to reassign apps across workspaces. No workarounds are available, so upgrading is required.
GitHub Advisory DatabaseFix: Update to one of the patched versions: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (depending on your release line). The fix adds a validation check that enforces a maximum file size limit (MaxFileSize = 100 MiB) before memory allocation. Alternatively, as a workaround, restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts only.
GitHub Advisory DatabaseFix: Update to a patched version: v2.34.2 (for release line 2.34), v2.33.8 (for 2.33), v2.32.7 (for 2.32), or v2.29.17 (for 2.29 ESR). The fix validates HostnameSuffix and SSHConfigOptions against a strict character set that rejects newlines and other control characters. As a temporary workaround before updating, inspect the output of `coder config-ssh --dry-run` before applying changes.
GitHub Advisory Database