AI & LLM Vulnerabilities

Microsoft 365 Copilot's Business Chat has a vulnerability where special characters are not properly filtered before being used in commands, allowing attackers to inject malicious commands (command injection, where an attacker sneaks unauthorized instructions into a system by exploiting how it processes input). This could let unauthorized people access and steal sensitive information across the network.

Azure Machine Learning contains a vulnerability where authorization checks (the system that verifies whether a user is allowed to perform an action) are not working correctly, allowing an attacker without permission to access and steal sensitive information over the internet.

AI Agent Automation, a platform for managing AI workflows with scheduling and monitoring tools, has a vulnerability in versions before 0.9.1 where authenticated users can manipulate file paths to escape the intended workspace directory and read sensitive files or overwrite files that the application can access. The vulnerability occurs because the system doesn't verify that file paths stay within approved directories after resolving them.

AI Agent Automation, a platform that runs automated AI workflows (sequences of actions controlled by AI), had a security flaw in versions before 0.9.1 where three memory functions (listMemories, deleteMemory, and clearAgentMemory) didn't properly verify that an authenticated attacker (someone who had valid login credentials) actually owned the data they were accessing. This meant an attacker could read, delete, or clear another user's conversation history and agent data if they knew that user's identifiers, breaking the isolation between different users' data.

SQLBot is a system that converts natural language questions into SQL database queries using AI and RAG (retrieval-augmented generation, where external data sources help the AI answer questions). Before version 1.9.0, the system failed to safely handle user-supplied table names when building SQL queries, allowing authenticated attackers to use special PostgreSQL functions to read sensitive files like /etc/passwd (which contains user account information) and configuration files, potentially exposing secrets and source code.

SQLBot, a system that converts natural language questions into database queries using AI and external data retrieval, had a security flaw before version 1.9.0 where authenticated users could upload SVG image files with embedded malicious code. When other users viewed these images, the malicious code would run in their browser session, potentially allowing attackers to steal data or perform actions on behalf of victims (this vulnerability is called stored cross-site scripting, where harmful code is saved and executed later).

MCP Documentation Server versions 1.13.0 through 1.13.1 expose an unauthenticated API (a set of functions that other programs can call) on all network interfaces instead of restricting it to localhost (the local computer only), allowing attackers on the same network to read, search, insert, or delete documents without a password. The vulnerability requires network access from a local area network, virtual machine network, or similar connected network, but does not allow remote code execution (running arbitrary commands on the server).

Kedro-Datasets (a tool that connects data sources to Kedro, a framework for building data pipelines) had a vulnerability in versions 5.0.0 through 9.5.0 where its PyTorch model loader didn't safely load .pt files, allowing attackers to run arbitrary code (RCE, remote code execution) if someone loads a malicious model file from an untrusted source on PyTorch versions before 2.6. This only affected users of the optional experimental component and only when loading untrusted files.

LiteLLM is a proxy server (a middleman that forwards requests to AI language model services) that had a security flaw before version 1.83.9. An authenticated user could sneak an api_base parameter (which controls where requests are sent) inside a user_config section of their request to bypass safety checks, allowing them to redirect the server's requests to internal systems or external servers they shouldn't normally access.

Stanza is a Python library from Stanford for processing natural language (breaking text into words, sentences, identifying named entities, and analyzing grammar structure). Before version 1.14.0, it had a security flaw where it extracted downloaded files without checking if they tried to escape their intended folder, allowing a malicious file to overwrite important system files and potentially run harmful code.