AI & LLM Vulnerabilities

Flowise has a critical IDOR (insecure direct object reference, a flaw where an app trusts user input to identify which data to access without checking permissions) vulnerability in its login configuration endpoint. An attacker with a free account can modify any organization's single sign-on settings by simply specifying a different organization ID, enabling account takeover by redirecting logins to attacker-controlled credentials and bypassing enterprise license restrictions.

A mass assignment vulnerability (a type of attack where an attacker controls internal fields by sending them in a request) exists in Flowise's `/api/v1/leads` endpoint, allowing unauthenticated users to override auto-generated fields like `id`, `createdDate`, and `chatId` by including them in the request body. The vulnerability occurs because the code uses `Object.assign()` to copy all properties from user input directly into the database entity without filtering, bypassing the intended auto-generation of these fields.

Flowise has a file upload vulnerability where the server only checks the `Content-Type` header (MIME type spoofing, pretending a file is one type when it's actually another) that users provide, instead of verifying what the file actually contains. Because the upload endpoint is whitelisted (allowed without authentication), an attacker can upload malicious files by claiming they're safe types like PDFs, leading to stored attacks or remote code execution (RCE, where attackers run commands on the server).

Flowise has a critical authorization bypass flaw in its `/api/v1` routes where the middleware trusts any request with the header `x-request-from: internal`, even though this header can be spoofed by any user. This allows a low-privilege authenticated tenant (someone with a valid browser cookie) to call internal administration endpoints, like API key creation and credential management, without proper permission checks, effectively escalating their privileges.

GitHub Copilot CLI had a vulnerability where attackers could execute arbitrary code by hiding dangerous commands inside bash parameter expansion patterns (special syntax for manipulating variables). The safety system that checks whether commands are safe would incorrectly classify these hidden commands as harmless, allowing them to run without user approval.

OpenChatBI is a chat-based business intelligence tool that uses large language models to help users analyze data through conversation. Before version 0.2.2, it had a critical path traversal vulnerability (CWE-22, a flaw that lets attackers access files outside their intended directory) in its save_report tool because it didn't properly check the file_format input parameter. This vulnerability had a CVSS score (severity rating) of 8.7, indicating it was high-risk.

OpenSift, an AI study tool that uses semantic search (finding information based on meaning rather than exact word matches) and generative AI to analyze large datasets, had a security vulnerability in versions before 1.6.3-alpha. The vulnerability was an SSRF (server-side request forgery, where an attacker tricks the server into making requests to unintended locations) that allowed attackers to bypass security checks by using private URLs, non-standard ports, or redirects that the URL intake system didn't properly restrict.

OpenSift is an AI study tool that uses semantic search (finding information based on meaning rather than exact keywords) and generative AI to analyze large datasets. Before version 1.6.3-alpha, the software had a path-injection vulnerability (a flaw where attackers could manipulate file paths to access files outside intended directories) in its file storage system, allowing potential unauthorized file read, write, or delete operations.

Langchain Helm Charts (tools for deploying Langchain applications on Kubernetes, a container orchestration system) versions before 0.12.71 had a URL parameter injection vulnerability (a flaw where attackers trick the system by inserting malicious data into URLs) in LangSmith Studio that could steal user authentication tokens through phishing attacks. If a user clicked a malicious link, their bearer token (a credential proving their identity), user ID, and workspace ID would be sent to an attacker's server, allowing the attacker to impersonate them and access their LangSmith resources.

Fickling, a security tool that checks if pickle files (serialized Python objects) are safe, was missing three standard library modules from its blocklist of dangerous imports: `uuid`, `_osx_support`, and `_aix_support`. These modules contain functions that can execute arbitrary commands on a system, and malicious pickle files using them could bypass Fickling's safety checks and run attacker-controlled code.

NLTK (a natural language processing library) versions up to 3.9.2 have a vulnerability called path traversal (where an attacker manipulates file paths to access files outside intended directories) in its CorpusReader classes. This allows attackers to read sensitive files on a server when the library processes user-provided file paths, potentially exposing private keys and tokens.