Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Ouroboros (an AI tool) has a remote code execution vulnerability where loading a `.env` file (a configuration file with environment variables) from a cloned repository could let an attacker run malicious code on your system. The flaw occurs because Ouroboros reads execution-controlling settings like CLI paths directly from the project directory's `.env` file without checking if they're trustworthy, allowing an attacker to point these paths to their own malicious scripts.
Fix: The vulnerability has been patched in version 0.39.0 via PR #1078. The fix applies a denylist that blocks execution-affecting environment variables from being loaded from the project directory's `.env` file, while still allowing trusted configurations from the user's home directory (`~/.ouroboros/.env`). Users are strongly advised to upgrade to version 0.39.0 or later. If upgrading is not immediately possible, users must carefully inspect any `.env` file inside cloned repositories before running Ouroboros commands to ensure it does not contain unexpected `OUROBOROS_*_CLI_PATH` or `OPENCODE_CLI_PATH` overrides.
GitHub Advisory DatabaseFastGPT, an AI Agent building platform, had a vulnerability in its JavaScript sandbox worker that failed to properly block dynamic imports (a way to load code at runtime). An attacker could bypass the security filter using a comment syntax (import/**/("child_process")) that the filter didn't recognize, allowing them to execute arbitrary commands inside the sandbox container.
FastGPT, an AI Agent building platform, had a Server-Side Request Forgery (SSRF) vulnerability (a flaw that lets attackers trick a server into making requests to internal systems it shouldn't access) in versions before 4.15.0-beta1. An authenticated attacker could bypass security protections and make unauthorized requests to internal network services by exploiting an incomplete fix in the dataset preview endpoint when using the externalFile data import type.
SillyTavern, a locally installed tool for interacting with AI text and image generation models, had a vulnerability in versions before 1.18.0 where the /api/search/searxng endpoint allowed authenticated users to trick the server into making requests to internal or hidden services (SSRF, or server-side request forgery, where an attacker manipulates a server into accessing resources it shouldn't). An attacker could use this to access data from services that should only be available internally.
SillyTavern is a locally installed interface for interacting with text generation AI models and other AI tools. Versions before 1.18.0 had a vulnerability where the corsProxyMiddleware (a component that handles web requests) would forward user-supplied URLs directly to the fetch function without proper security checks, allowing SSRF (server-side request forgery, where an attacker tricks the server into making requests to unintended targets) attacks.
SillyTavern is a locally installed interface for interacting with text generation AI models and related tools. Prior to version 1.18.0, the software had a cross-site scripting vulnerability (XSS, where attackers inject malicious code into web pages), because user-controlled URLs were displayed in error messages without being HTML-escaped (made safe for web display), allowing attackers to inject harmful scripts.
SillyTavern is a locally installed interface for interacting with text generation AI models, image generators, and voice tools. Prior to version 1.18.0, a vulnerability allowed attackers to delete the entire user extensions directory without authentication by sending a specially crafted request to the delete endpoint that bypassed filename validation (a security check that prevents malicious file paths).
SillyTavern, a locally installed interface for interacting with AI language models and image generators, had a vulnerability in versions before 1.18.0 where it trusted HTTP headers (Remote-User and X-Authentik-Username) used by single sign-on systems without verifying they came from a trusted source. This meant anyone who could connect directly to SillyTavern could fake these headers to log in as any user, including administrators, without a password, but only if SSO was explicitly enabled in the configuration.
SillyTavern is a locally installed interface for interacting with text generation AI models. Before version 1.18.0, it had a security flaw where changing a password or recovering an account didn't log out existing sessions, because all session information was stored in a signed cookie (a small piece of data the browser keeps) rather than on the server, making it impossible to revoke access even after a password change.
RAGFlow, an open-source RAG (retrieval-augmented generation, where an AI pulls in external documents to answer questions) engine, has a Jinja2 template injection vulnerability (a flaw where untrusted data gets processed as code in a templating system) in version 0.24.0 and earlier. Any registered user can exploit this flaw in the prompt generator to run arbitrary OS commands (any commands they want) on the server by creating a Canvas workflow with specific components.
A sandbox escape vulnerability in nono (a sandboxing tool using Landlock/seccomp, which are Linux security features that restrict what programs can do) allows processes running inside the sandbox to break out by communicating with systemd D-Bus sockets (the inter-process communication system that manages user services). An AI agent or untrusted tool with bash access could exploit this to write files or run commands outside the sandbox with the user's permissions.
vLLM version 0.14.1 has a security flaw where a setting called `trust_remote_code` is permanently turned on in two model files, even when users try to turn it off. This allows RCE (remote code execution, where attackers can run harmful code on your computer) through malicious models downloaded from HuggingFace, a popular model repository. This is a partial fix attempt for two earlier vulnerabilities that didn't fully solve the problem.
OpenTelemetry Go's `ParseFile` function has a file descriptor leak (a reference to an open file that is never closed), where each call to parse a schema file leaves the file open in memory. In a long-running application that repeatedly parses schema files, these open files can accumulate until the process runs out of available file descriptors and crashes, causing a denial of service (unavailability).
A removed safety check in OpenTelemetry Go's baggage parsing (the mechanism for passing contextual data between services) allows attackers to send extremely large or malformed baggage headers that consume excessive CPU and memory while being fully processed and logged, creating a denial-of-service vulnerability. The parser no longer rejects oversized inputs upfront and instead processes every invalid member completely, sending errors to the logging system by default.
claude-code-cache-fix is a tool that speeds up Claude Code by caching results. Versions 3.5.0 through 3.5.1 have a code injection vulnerability (CWE-94, inserting malicious code into a program) in a file called tools/quota-statusline.sh, where user input containing certain byte sequences (''') can break out of a Python string and execute arbitrary code on the user's system. This is a high-severity bug that affects local attackers who can control the input to Claude Code.
Langroid versions before 0.63.0 have a vulnerability where SQLChatAgent (a tool that lets an AI execute SQL queries) can be tricked through prompt injection (hiding malicious instructions in input data) into running dangerous SQL commands. If the database is configured with elevated privileges, an attacker can achieve RCE (remote code execution, where an attacker runs commands on a system they don't own) on the database server, potentially stealing or deleting data.
Gradio versions before 6.15.0 have a cookie injection vulnerability that lets attackers perform session fixation (tricking a system into using a fake session ID) across multiple user spaces. An attacker controlling one Gradio Space can inject a cookie into a shared HTTP client (a tool that sends web requests) that automatically gets sent to all other legitimate Spaces, affecting every user on that Gradio deployment.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.0 has a vulnerability that allows a denial of service attack, which is when an attacker overwhelms a system with requests to make it unavailable. The problem is caused by uncontrolled resource consumption (the system fails to limit how much memory, CPU, or other resources a single request can use).
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.1 has a vulnerability that could allow remote code execution (running malicious code on a system from a distance) because it doesn't properly validate symbolic links (shortcuts that point to files) when extracting archive files. This is a path traversal (CWE-22) weakness, meaning an attacker could potentially access or execute files outside the intended directory.
Fix: This vulnerability is fixed in version 4.15.0-beta1.
NVD/CVE DatabaseFix: Update FastGPT to version 4.15.0-beta1 or later, where this vulnerability is fixed.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 1.18.0.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 1.18.0.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 1.18.0. Users should update SillyTavern to 1.18.0 or later.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 1.18.0. Users should update SillyTavern to 1.18.0 or later.
NVD/CVE DatabaseFix: Update SillyTavern to version 1.18.0 or later, which fixes the vulnerability.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 1.18.0.
NVD/CVE DatabaseFix: The source states: 'Support for restricting this behavior has since been added and the fix is available in the repository pending release.' However, no specific version number, patch details, or explicit mitigation steps are provided in the text.
GitHub Advisory DatabaseFix: This vulnerability is fixed in version 3.5.2. Users should update to claude-code-cache-fix 3.5.2 or later.
NVD/CVE DatabaseFix: Fixed in v0.63.0 by defaulting SQLChatAgent to a SELECT-only sqlglot-parsed statement allowlist (a list of approved SQL operations) with a dialect-aware dangerous-pattern blocklist. Users can restore the previous unrestricted behavior by setting allow_dangerous_operations=True, but only for trusted deployments.
GitHub Advisory DatabaseGryph is a security tool that protects AI coding agents (software that writes code with AI help) by controlling what information gets saved to a local database. Before version 0.7.0, Gryph's documentation incorrectly stated that logging (recording activity) was set to a minimal level by default, but it was actually set to standard, causing sensitive file content to be stored in the database even though Gryph was supposed to filter it out.
Fix: This vulnerability is fixed in version 0.7.0.
NVD/CVE DatabaseFix: Update Gradio to version 6.15.0 or later. The vulnerability is fixed in the release available at https://github.com/gradio-app/gradio/releases/tag/gradio%406.15.0.
NVD/CVE Database