Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
The `multiedit` tool in PraisonAI allows an AI agent to read and write any file on the system without checking file paths or boundaries, because it passes the filepath directly to the `open()` function without validation. An attacker who can control what the agent does, such as through crafted prompts or malicious workflow configurations, could steal sensitive files like SSH keys and credentials, or overwrite important files to take control of the system.
A vulnerability (CVE-2026-12530) was found in the AWS Bedrock AgentCore Python SDK's install_packages() method, which failed to properly block dangerous characters in package names before running them as shell commands. This allowed attackers to use flags like '--index-url' to redirect package downloads to fake servers or '-r' to read files from the sandbox system. Versions 1.1.3 through 1.6.0 are affected.
Langflow versions before 1.9.1 allow anyone with network access to upload unlimited amounts of data to the server without logging in, which can exhaust disk space and cause the service to stop working (DoS, or denial-of-service). Additionally, the server reveals the exact file path where uploads are stored, giving attackers information that could help them chain together multiple attacks.
LangChain4j's MariaDB and pgvector embedding stores have a SQL injection vulnerability (a type of attack where an attacker inserts malicious SQL code into a query) caused by improperly escaping metadata filter keys before putting them into SQL queries. An attacker who can control the filter keys in search or remove operations could inject arbitrary SQL to steal data, cause denial of service, or delete rows from the database.
Claude Code had a security flaw where the domain huggingface.co was automatically approved for the WebFetch tool (a feature that lets AI systems fetch data from the internet), allowing attackers to trick Claude into making web requests to attacker-controlled files and secretly stealing data like files or environment variables without user permission. An attacker would need to first inject malicious content into Claude's context (the information it's working with) to exploit this vulnerability.
Open WebUI has a security flaw where authenticated users can access other users' files through the `/api/chat/completions` endpoint. When a user sends an image request with a file ID (instead of a web link) in the `image_url` field, the server reads that file from disk without checking if the user owns it, then converts it to a format the AI can process. An attacker can exploit this by using another user's file ID to make the AI read and describe private files, leaking their content.
vLLM's audio transcription endpoint checks the size of compressed audio files but not the decoded output, allowing a decompression bomb attack. A 25MB OPUS file can expand to about 14.9GB of PCM audio (raw, uncompressed audio data) in memory, letting an attacker crash the server by exhausting RAM with just a few requests.
vLLM's fix for an earlier vulnerability (CVE-2026-22778) was incomplete, leaving five code paths in the Anthropic router and speech-to-text API that still leak memory addresses. When users send malformed image data, the PIL library raises an error message containing a BytesIO object's memory address (like `<_io.BytesIO object at 0x7a95e299e750>`), and these five locations pass the error directly to clients without removing the address, defeating ASLR (address space layout randomization, a security feature that randomizes where code lives in memory).
vLLM's GGUF dequantize kernels (specialized functions for decompressing quantized neural network weights) use a 32-bit integer parameter to specify tensor size, which truncates when processing very large tensors. This causes the output tensor to be only partially filled by the processing kernel, leaving the remaining memory uninitialized. In multi-tenant deployments (where multiple users share GPU hardware), this unfilled memory may retain sensitive data from other users' previous requests, leaking their information.
vLLM, an AI framework for running large language models, has three image processing bugs that cause mismatches between what the model sees and what users expect. First, EXIF orientation data (metadata that tells how an image should be rotated) is ignored, so rotated images are processed in the wrong orientation. Second, PNG images with transparency information (the tRNS chunk, which marks certain pixels as see-through) aren't properly flattened to solid colors before processing, causing transparent pixels to become visible or distorted. Third, animated PNG and GIF files only process their first frame. These issues could alter how the model interprets image content.
vLLM has a validation bypass where temperature values set to NaN (not-a-number) or positive Infinity pass all safety checks because comparison operators silently return False for these special float values in Python. These invalid values then reach GPU sampling kernels, causing crashes that take down the inference worker and affect all users running models on it.
n8n had a security flaw where three endpoints that change data in workflow test runs used the wrong permission scope (workflow:read instead of workflow:execute), allowing users with read-only access to start, cancel, and delete test runs they shouldn't be able to modify. This only affected enterprise versions with Advanced Permissions enabled.
Pi Agent, a coding assistant tool, had a security weakness in how it exports chat sessions to HTML files. Attackers could hide malicious links in Markdown (a text formatting system) by using special control characters that browsers would ignore, allowing XSS (cross-site scripting, where malicious code runs in a webpage) to execute in the exported HTML file if a user clicked the link. The attack requires multiple steps: an attacker must inject harmful content into a session, the user must export it as HTML, and the user must click the malicious link.
LiteLLM proxy had an authentication bypass vulnerability where a crafted Host header (the part of a web request that specifies which server is being contacted) could trick the auth layer into checking the wrong route, potentially allowing unauthorized access to protected management features. Most deployments are protected because upstream security layers like CDNs or reverse proxies validate the Host header, and LiteLLM Cloud customers are not affected.
An authenticated user in n8n (a workflow automation platform) could trick the SecurityScorecard node (a component that connects to SecurityScorecard's API) into sending an API token (a credential for accessing the service) to an attacker's server by configuring it to download reports from a malicious URL, bypassing security restrictions meant to limit where credentials can be sent. This allows the attacker to steal the API token and use it themselves.
When n8n's MCP Browser tool runs in HTTP transport mode (a way of sending data over the network), it accepts requests without authentication (verification of identity), meaning anyone on the network or visiting a website can control the user's browser, including navigating to sites, running code, and accessing cookies and stored data. This vulnerability only affects the HTTP transport mode; the default stdio transport (direct computer communication) is safe.
n8n (a workflow automation tool) has a security flaw in its Enterprise Edition where three endpoints for the Dynamic Credentials feature (a system that manages authentication tokens across workflows) fail to check if users should have access to specific workflows or credentials. An authenticated attacker could steal another user's credential tokens, take over their integrations, or disable their credentials entirely, affecting any workflows that rely on those credentials.
A vulnerability in n8n (a workflow automation tool) allowed member-level users with editor access to shared workflows to access credentials (stored login information) they shouldn't have permission to use, because permission checks weren't fully enforced on certain API endpoints. This only affected instances where workflow sharing was enabled and workflows had been shared with member-level editors.
A vulnerability in n8n's Compression node allows unauthenticated attackers to crash the entire application by sending specially crafted compressed files to public webhooks. The node decompresses archives without limiting memory usage, causing the process to run out of memory and stop working for all users on that server.
Splunk Enterprise has a critical security flaw where a PostgreSQL sidecar service endpoint (a supporting service that handles database connections) doesn't require authentication (proof of identity), allowing an attacker without credentials to create or delete arbitrary files. This vulnerability is currently being exploited in real attacks in the wild.
Fix: Upgrade to Langflow version 1.9.1 or later. The fix adds authentication requirements to the upload endpoint (users must log in and own the flow), enforces file size limits (returns HTTP 413 if exceeded), and only reveals file paths to authenticated flow owners.
GitHub Advisory DatabaseFix: Fixed in langchain4j-mariadb and langchain4j-pgvector version 1.16.3-beta26. The patch properly escapes JSON filter keys before embedding them in SQL string literals (doubling single quotes for PostgreSQL and escaping backslash and single quote for MariaDB), escapes backslash and single quote in MariaDB string values, and validates or quotes column-mode keys as identifiers instead of concatenating them as raw SQL.
GitHub Advisory DatabaseFix: Users on standard Claude Code auto-update have received this fix already; users performing manual updates are advised to update to the latest version.
Hugging Face Security AdvisoriesFix: A fix for this vulnerability was merged in pull request #44970 on the vLLM GitHub repository: https://github.com/vllm-project/vllm/pull/44970
GitHub Advisory DatabaseFix: Change the `int k` parameter to `int64_t k` in the `to_cuda_ggml_t` function pointer type declaration at `ggml-common.h:1067`. The source text states: "This is a single root cause -- the `int` type on the `k` parameter in `to_cuda_ggml_t` -- with a single fix: change `int k` to `int64_t k`. All dequantize functions inherit this type through the same typedef."
Hugging Face Security AdvisoriesFix: A fix was merged in vLLM pull request #44974 (https://github.com/vllm-project/vllm/pull/44974). The source text does not provide specific details about what changes were made in that fix.
GitHub Advisory DatabaseFix: Add a `math.isfinite(self.temperature)` check in the `_verify_args()` function to reject non-finite float values with a 400 error. A fix was merged in https://github.com/vllm-project/vllm/pull/45116
GitHub Advisory DatabaseFix: Upgrade to n8n version 1.123.55, 2.25.7, or 2.26.2 or later. As temporary workarounds if upgrading immediately is not possible: restrict project membership to fully trusted users only, or avoid granting viewer access to projects containing sensitive workflows (though these do not fully remediate the risk).
GitHub Advisory DatabaseFix: Upgrade @earendil-works/pi-coding-agent to version 0.78.1 or later. Version 0.78.1 fixes the issue by sanitizing (cleaning) Markdown links and image URLs using an allow-list (a list of approved safe formats) after removing C0 control characters. Users of the old @mariozechner/pi-coding-agent package should migrate to the new @earendil-works/pi-coding-agent package and upgrade to version 0.78.1 or later. Regenerate any shared HTML exports after upgrading if the original sessions contained untrusted content.
GitHub Advisory DatabaseFix: Fixed in version 1.84.0. Upgrade to 1.84.0 or later with no configuration change required. If upgrading is not immediately possible, place the proxy behind an upstream component that validates or normalizes the Host header before forwarding, such as a CDN/WAF (web application firewall), a reverse proxy with explicit server_name allowlists, or a cloud load balancer with host-based routing rules, or restrict network access to the proxy listener.
GitHub Advisory DatabaseFix: The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can temporarily: limit workflow creation and editing permissions to fully trusted users only, or disable the SecurityScorecard node by adding `n8n-nodes-base.securityScorecard` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
GitHub Advisory DatabaseFix: The issue has been fixed in n8n versions 2.25.7 and 2.26.2. Users should upgrade to one of these versions or later. As temporary workarounds while waiting to upgrade: avoid running MCP Browser with HTTP transport and use the default stdio transport instead, or if HTTP transport is necessary, restrict network access to the listening port to trusted clients only using host-based firewall rules. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.
GitHub Advisory DatabaseFix: The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can temporarily restrict n8n instance access to fully trusted users only, or disable the Dynamic Credentials feature by unsetting `N8N_ENV_FEAT_DYNAMIC_CREDENTIALS`. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
GitHub Advisory DatabaseFix: The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can temporarily restrict workflow sharing to fully trusted users only and audit shared workflows for unexpected credential references or recent modifications, though these workarounds do not fully remediate the risk.
GitHub Advisory DatabaseFix: The issue has been fixed in n8n version 2.24.0. Users should upgrade to this version or later. The fix introduces configurable limits on decompressed output size (`N8N_COMPRESSION_NODE_MAX_DECOMPRESSED_SIZE_BYTES`) and ZIP entry count (`N8N_COMPRESSION_NODE_MAX_ZIP_ENTRIES`). If upgrading is not immediately possible, administrators can temporarily disable the Compression node by adding `n8n-nodes-base.compression` to the `NODES_EXCLUDE` environment variable, or restrict public webhook workflows that accept archive file uploads to authenticated endpoints only.
GitHub Advisory Database