Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
The SearXNG MCP Server's `web_url_read` tool has a vulnerability where it enforces a 5 MiB (megabyte) response size limit only by checking the `Content-Length` header in an initial HEAD request. When a server doesn't include this header, the size check fails and the tool loads the entire response into memory without any limit, allowing an attacker to force the server to consume unlimited memory and CPU, causing a denial of service (DoS, a situation where a system becomes unavailable).
Fix: Replace both `response.text()` calls with a streaming reader that aborts once the byte counter exceeds `maxContentLengthBytes`. The source text states: 'Replace both `response.text()` calls with a streaming reader that aborts once the byte counter exceeds `maxContentLengthBytes`' but does not provide the specific code implementation.
GitHub Advisory DatabaseThe `EnvironmentManager.restore()` function in Network-AI 5.12.1 is vulnerable to path traversal (a technique where an attacker uses sequences like `../` to access files outside the intended directory). An attacker can pass a malicious backup ID to copy arbitrary files from anywhere on the system into the environment's data folder, potentially exposing sensitive information or breaking environment isolation.
Network-AI versions up to 5.12.1 have a vulnerability in the `EnvironmentManager.backup()` function where it follows symlinks (shortcuts to other directories) when collecting files to back up. An attacker who can create a symlink in the environment data directory can trick the backup process into copying files from outside the intended environment root directory, potentially exposing sensitive information in backup artifacts.
Network-AI's AgentRuntime sandbox uses a flawed string-prefix check to keep file access within a configured base directory, but the check is too broad. A sandbox at `/tmp/network-ai-sandbox` also matches the sibling directory `/tmp/network-ai-sandbox_evil`, allowing agents to read or list files outside the intended sandbox boundary. This vulnerability affects Network-AI version 5.12.1 and has a medium severity CVSS score (a 0-10 rating of how severe a vulnerability is).
Langflow's file-reading components (like Read File and Docling) have a vulnerability where attackers can use symlinks (shortcuts that point to other files) hidden inside compressed files to read any file on the system, potentially stealing secret keys and executing arbitrary code. An attacker could steal the JWT token secret (used for authentication), forge login tokens for any user, and then run malicious code through the Python Interpreter node.
An attacker can crash Langflow (an AI application framework) by sending a specially crafted file upload request with an extremely long multipart form boundary (a delimiter used in form data) without needing to log in, making the server unusable for all users indefinitely. The vulnerability exists because the server tries to process the malformed data before checking if the user is authenticated.
Langflow's logout button fails to properly clear user sessions, leaving authentication tokens (access_token_lf and refresh_token_lf) in the browser's storage, so the previous user remains logged in until someone else logs in explicitly. This happens because the logout endpoint doesn't delete cookies with the same security settings they were created with, and the frontend doesn't clear stored tokens either. On shared computers, users may incorrectly think they've logged out when they haven't.
Langflow versions before 1.9.1 had an IDOR vulnerability (insecure direct object reference, where attackers can access resources by guessing or knowing their ID) in the `/api/v1/responses` endpoint that allowed any authenticated user to execute another user's workflow by specifying that user's flow ID, potentially exposing sensitive data and wasting resources. The bug existed because the code queried the database directly using a flow's unique identifier without checking if the requesting user actually owned that flow.
The agentic-flow tool versions 2.0.13 and earlier had a critical vulnerability where user input was directly inserted into shell commands without sanitization, allowing attackers to inject arbitrary OS commands (CWE-78, a type of command injection). This affected multiple MCP server tools, particularly those handling agent and database parameters, and could be exploited through untrusted content processed by the AI agent.
Ouroboros-ai had an incomplete security fix where a malicious project's `.env` file (configuration file automatically loaded when code imports the package) could still enable remote code execution (RCE, where an attacker runs commands on your system) through missing environment variable names in the denylist (block list). Additionally, the software was auto-loading configuration files from the current working directory without checking if they were trustworthy, allowing attackers to execute arbitrary commands just by running the tool inside a malicious repository.
agent-coderag has a critical vulnerability where it automatically executes a `gradlew` script (a build automation file) from any repository during its default dependency-discovery process, without checking if the script is legitimate. An attacker can place a malicious `gradlew` script in a fake repository to run arbitrary code (unrestricted commands) on a victim's computer whenever they run the standard `agent-coderag sync` command, requiring no special permissions or authentication.
The tract-onnx library (a Rust crate for running neural network models) has a vulnerability where it loads external data files referenced in ONNX models without checking the file paths. A malicious model can use absolute paths (like `/etc/passwd`) or directory traversal sequences (like `../../../../etc/passwd`) in the `location` field to trick tract into reading arbitrary files on the system and exposing their contents in the model's output. This is a path-traversal vulnerability (a type of attack where an attacker manipulates file paths to access files outside the intended directory).
Network-AI versions before 5.9.1 have a command injection vulnerability where wildcard allowlist rules like `git *` can be bypassed to run arbitrary commands. The bug occurs because the allowlist (a security filter that approves which commands can run) matches the whole command string using loose glob patterns, but then executes it through `/bin/sh -c` (the shell interpreter), which interprets special characters like semicolons and pipes, allowing an attacker to append malicious commands like `git status; id`.
The Network-AI package (npm `network-ai`, v5.7.1) has an incomplete security fix for CVE-2026-46701. While a previous update blocked browser-based attacks by restricting CORS (cross-origin resource sharing, which controls what websites can access a server), the core problem remains: the server still defaults to an empty secret and accepts all requests without authentication, meaning anyone who can reach the server directly (via curl, SSRF (server-side request forgery, where an attacker tricks a server into making requests), or a non-loopback network bind) can invoke all 22 available tools without providing credentials.
AgenticMail has a security flaw where unauthenticated external emails can trigger a privileged Claude Code session with `permissionMode: 'bypassPermissions'` (a mode that removes safety restrictions). The email's sender address, subject, and preview are embedded directly into the AI's prompt without verification that the sender is the actual operator, allowing prompt injection (tricking the AI by hiding instructions in its input) that could lead to arbitrary code execution and file access under the operator's identity. A similar handler in the same codebase properly authenticates the sender, but the bridge-wake path does not.
Pipecat's development runner has an unauthenticated WebSocket endpoint (`/ws`) that accepts telephony connections without verifying who is connecting. An attacker can send a fake Twilio handshake message with a call ID they choose, and the server will use its own Twilio credentials to hang up that call, potentially terminating calls on the victim's account. The same vulnerability exists for Telnyx and Plivo telephony providers.
The githubreceiver component in opentelemetry-collector-contrib has a security flaw where it validates the `required_headers` configuration at startup but never actually checks these headers on incoming webhook requests. This means an attacker can send fake data to the webhook endpoint by bypassing the authentication headers that operators thought were protecting it, especially when the `secret` field is left empty (which skips HMAC validation entirely).
The Sentry exporter in opentelemetry-collector-contrib has a path traversal vulnerability (a type of attack where an attacker manipulates file paths to access unintended locations) because it builds Sentry API URLs by directly inserting the service.name attribute, which remote attackers can control, without checking if it's valid. Since the operator's bearer token (a credential that proves the operator's identity) is automatically added to every request, an attacker can craft a malicious service.name to reach privileged Sentry admin and organization endpoints that they shouldn't have access to.
PraisonAI's search tools contain a Server-Side Request Forgery (SSRF) vulnerability, where an attacker can trick the AI into making HTTP requests to arbitrary internal URLs by controlling the `searxng_url` parameter. Because this parameter is exposed to the language model as a tool option and search tools are enabled by default, an attacker can inject malicious instructions through web pages or files to make the server access internal services, read sensitive data, or in cloud environments reach the instance metadata endpoint (169.254.169.254) to potentially steal credentials.
Fix: Fixed in v5.12.2. Install with: `npm install network-ai@5.12.2`. The patched version now validates backup IDs against `/^[\w\-]+$/` (allowing only letters, numbers, underscores, and hyphens) and confirms that the resolved backup path stays within the `.backups/` directory before accessing the filesystem.
GitHub Advisory DatabaseFix: Fixed in v5.12.2. Install with `npm install network-ai@5.12.2`. The patch changes `_collectBackupFiles()` to use `lstatSync` instead of `statSync` and skips any entries where `isSymbolicLink()` is true, preventing the backup function from following symlinks outside the environment root.
GitHub Advisory DatabaseThe `ApprovalInbox` HTTP server in network-ai (version 5.11.0 and earlier) has no authentication and allows cross-origin requests (CORS, a mechanism that controls which websites can access a server). This means anyone who can reach the server—whether through the same computer, a website you visit in your browser, or a network connection—can view pending approvals and approve them without permission, bypassing the human-in-the-loop control (a safety check requiring a person to review high-risk actions before they run). This defeats protections meant to prevent the AI from executing dangerous operations like shell commands without consent.
Fix: Fixed in v5.12.2 (commit a59c13a). Users should upgrade to this version or later.
GitHub Advisory DatabaseFix: Upgrade to Langflow version 1.9.2 or later. The fix modifies the `BaseFileComponent._unpack_bundle` function to reject symlinks, hardlinks, and other non-regular file entries during TAR extraction, and adds additional symlink filtering during directory recursion and after extraction.
GitHub Advisory DatabaseFix: Upgrade to version 1.0.19 or later. The fix adds a `check_boundary` HTTP middleware that validates the multipart boundary using the pattern `^[\w\-]{1,70}$` and rejects malformed requests with HTTP 422 before the body is parsed. The upload endpoint also now requires authentication checks (`get_current_active_user`) and returns HTTP 403 if the user doesn't own the flow.
GitHub Advisory DatabaseFix: Upgrade to Langflow version 1.7.0 or later. The fix (PRs #10527 and #10528) ensures the logout endpoint deletes authentication cookies using the same parameters (httponly, samesite, secure, domain) they were created with, and the frontend now clears auth cookies on logout.
GitHub Advisory DatabaseFix: Update to Langflow 1.9.1 or later. The fix, released on 2026-04-22 in PR #12832, adds ownership verification so that when a flow is accessed by ID, the system checks whether the requesting user owns it. If they don't, the system returns a 404 error (instead of allowing access or revealing that the flow exists). The fix applies to both UUID-based lookups and endpoint name lookups, and includes additional protective layers for related endpoints like `/api/v1/run*` routes.
GitHub Advisory DatabaseFix: Upgrade to agentic-flow version 2.0.14 or later. The fix rewrites all affected command calls to use execFileSync(file, argv, { shell: false }), which passes arguments directly to the operating system without shell parsing, preventing injection attacks. Downstream packages (ruflo@3.12.4, claude-flow@3.12.4, @claude-flow/cli@3.12.4) have also been updated to pull the patched version.
GitHub Advisory DatabaseFix: Fixed in version 0.42.1. All vulnerable environment variable keys were added to the `_UNTRUSTED_ENV_DENYLIST`; the automatic working-directory configuration file discovery was removed and replaced with only explicit configuration via the `OUROBOROS_MCP_CONFIG` environment variable and `~/.ouroboros/mcp_servers.yaml` (both from trusted locations). The regression suite (automated tests) now derives from the source denylist to prevent incomplete fixes in the future.
GitHub Advisory DatabaseFix: Reject absolute `location` values and any `..` components, then canonicalize (convert to a standard absolute path form) and verify the resolved path stays within the model directory, mirroring the fix applied in the `onnx` reference library version 1.22.0.
GitHub Advisory DatabaseFix: Fixed in v5.9.1 (commit 379f776). The `ShellExecutor` now executes commands via `spawn(file, args, { shell: false })` with quote-aware argument parsing instead of invoking a shell, and `SandboxPolicy.isCommandAllowed` and the new `SandboxPolicy.tokenizeCommand` reject any unquoted shell metacharacters (`;`, `&`, `|`, `$`, backticks, parentheses, angle brackets, braces, and newlines) or unterminated quotes before checking the allowlist, while preserving quoted metacharacters as literal arguments.
GitHub Advisory DatabaseFix: The source recommends implementing the original advisory's remediation #1: 'refuse to start SSE mode with an empty secret (unless `--stdio`), and/or change `_isAuthorized` to fail closed (an empty configured secret should mean "deny", not "allow").' The fix should require a non-empty secret at startup and call `process.exit(1)` if one is not provided, rather than only issuing a warning when binding to a non-loopback address.
GitHub Advisory DatabaseFix: Add RequiredHeaders enforcement to `handleReq()` in `receiver/githubreceiver/trace_receiver.go`, matching the pattern used in gitlabreceiver at `receiver/gitlabreceiver/traces_receiver.go:266-270`, which validates each required header by checking if the incoming request's header value matches the configured value.
GitHub Advisory Database