Advisories

The default FileSessionManager in Strands Agents (strands-py) writes session data under /tmp/strands/sessions and relies on the process umask for permissions. With the common umask 022, session directories are 0755 and JSON files are 0644, so other local users can read persisted session data such as prompts, model output, tool inputs and outputs, and any secrets that pass through the agent. The issue was reproduced on commit dd7b41de38cb.

LiteLLM's proxy endpoint /sso/debug/callback reflected identity-provider-controlled fields into an inline script block using json.dumps, which does not escape HTML context characters such as </script>. An IdP string containing </script> could run attacker JavaScript in the proxy origin. The route needs no authentication, so an attacker with an account on the configured IdP could lure a logged-in proxy admin into opening the callback URL, enabling session cookie theft and potentially full admin account takeover.

Mem0's Python SDK before 2.0.18 and TypeScript SDK before 3.1.6 build session scope keys by joining caller-controlled user_id, agent_id, and run_id values with unescaped & and = delimiters in _build_session_scope() and Memory.buildSessionScope(). A caller can embed another scope component in an identifier so that distinct tenant tuples yield the same session_scope key, which Memory.add(), AsyncMemory.add(), and POST /memories use to read and save recent raw messages. This enables cross-tenant conversation disclosure and eviction or interleaving of another tenant's history.

ONNX versions prior to 1.22.0 have a flaw in _unpack_2bit() and _unpack_4bit(), which resize unpacked arrays based on attacker-controlled TensorProto.dims without checking that raw_data or int32_data holds the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor via onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator can expand a small packed payload into a disproportionately large allocation, exhausting memory.

ONNX versions 1.4.0 through 1.22.0 contain a flaw in ScanInferenceFunction, ScanInferenceFunction_opset8 and ScanInferenceFunction_opset9, which do not safely validate the required num_scan_inputs attribute. A missing attribute is dereferenced as a null pointer, and a negative value is converted to size_t and can reach an oversized allocation path. An untrusted model can terminate or disrupt shape inference, including a negative-value model that passes onnx.checker.check_model().

From ONNX 1.2.1 through 1.22.0, ConvTranspose shape inference indexes an empty effective_kernel_shape when a weight tensor has fewer than three dimensions and no kernel_shape attribute is set. An untrusted model that passes onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service; no confidentiality or integrity impact was demonstrated.

ONNX versions prior to 1.22.0 have a flaw in RNNShapeInference_opset1_to_6(), which handles malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without checking that the first input has rank three. The function reads dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field. An untrusted model that passes onnx.checker.check_model() can terminate an application that calls onnx.shape_inference.infer_shapes().

CVE-2026-115918 affects vLLM, an inference and serving engine for large language models, from version 0.16.0 through 0.32.0. An authenticated caller of the /v1/responses endpoint can supply an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is configured, because ChatParams.get_apply_chat_template_kwargs() keeps that value without enforcing trust_request_chat_template. The bypassed trust policy lets the attacker exhaust CPU or memory through Jinja rendering.

vLLM versions prior to 0.32.0 contain an off-by-one error in vllm/tokenizers/hf.py, where max_token_id is computed with an incorrect upper bound. A pre-tokenized prompt ID equal to the vocabulary size passes validation, and with tensor-parallel size one and a vocabulary that is an exact multiple of 64, VocabParallelEmbedding.forward does not mask it before F.embedding uses it. This triggers a CUDA device-side assertion that terminates the engine.