AI & LLM Vulnerabilities

LMDeploy versions 0.9.2 through 0.15.x have a remote code execution vulnerability in their DistServe feature, which uses pickle deserialization (a Python method that can accidentally run malicious code while unpacking data) on messages from untrusted ZeroMQ sockets. An attacker who can send requests to the `/distserve/p2p_connect` endpoint can trick the server into connecting to a malicious endpoint and executing arbitrary code with the privileges of the LMDeploy process, especially if API-key authentication is not enabled.

M365 Copilot has a command injection vulnerability (a flaw where special characters in user input can trick the system into running unintended commands), which allows an authorized attacker to gain higher privileges over a network. The vulnerability affects users who already have some level of access to the system.

SQLBot is a system that converts natural language questions into SQL database queries using AI and RAG (retrieval-augmented generation, where the system pulls in external data to help answer questions). Before version 1.9.0, authenticated users could exploit a second-order SQL injection (a type of attack where malicious code is stored first, then executed later) by crafting a fake table name in an Excel configuration file, which would then run as dangerous commands when the datasource was deleted.

SQLBot, a system that converts natural language questions into database queries using AI and RAG (retrieval-augmented generation, where the AI pulls in external data), had a vulnerability before version 1.9.0 where attackers could upload files with misleading names that tricked the system into saving malicious Python code to a special folder. When SQLBot restarted or updated its database structure, it would accidentally run the attacker's code.

LMDeploy versions 0.9.1 through 0.10.1 contain a remote code execution vulnerability (RCE, where an attacker can run commands on a system they don't own) in its RPC server (a service that handles requests from other computers). The vulnerability exists because the server uses pickle.loads() (a Python function that converts serialized data back into code) directly on incoming messages without checking if they're safe, allowing attackers to execute malicious code.

A vulnerability called bucket squatting (exploiting unprotected cloud storage locations) in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions before 1.166.1 lets attackers run arbitrary code on systems (RCE, remote code execution) and steal authentication tokens belonging to tenant projects (shared computing environments).

IBM Langflow OSS versions 1.0.0 through 1.10.0 have a critical vulnerability where attackers can run arbitrary Python code (code that does whatever the attacker wants) with root privileges (the highest access level) by uploading components that import socket or urllib libraries. This allows attackers to steal AWS credentials, steal files from the server, or attack other services like PostgreSQL and Redis running on the same network, while a faulty security check incorrectly marks these malicious components as safe.

PraisonAI, a system that coordinates multiple AI agents working together, had a vulnerability in versions before 4.6.59 where an attacker could send commands to an unprotected API endpoint and trick the system into running arbitrary operating system commands without needing a password or approval. The vulnerability existed because the approve field could mark commands as safe before proper security checks happened.

A security vulnerability in Mistral Vibe allows attackers to run unauthorized code by sneaking environment variable assignments (settings that control how programs behave) before allowlisted commands, which bypasses the permission checks that normally prevent this. The vulnerability works because these environment variable assignments are not inspected for safety before the command runs.

Mistral Vibe contains a vulnerability where attackers can bypass security checks that normally prevent unauthorized commands from running by using ANSI-C quoted arguments (a special text formatting method). This allows someone to modify an approved command so it secretly runs malicious code on a user's computer without permission.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.11.5 has a vulnerability that allows an attacker to run arbitrary code (any commands they want) on a system by injecting malicious code during graph construction (the process of building the visual workflow/logic structure in Langflow).

IBM Langflow OSS versions 1.0.0 through 1.11.5 have a vulnerability that lets remote attackers run arbitrary OS commands (unauthorized instructions on the underlying operating system) because the software doesn't properly filter dangerous characters in user input before using it in system commands.

IBM Langflow OSS versions 1.0.0 through 1.11.5 has a vulnerability that lets unauthenticated attackers (those without login credentials) run arbitrary code (any commands they want) and access or change chat sessions through publicly shared project endpoints, because the software doesn't properly restrict access to public flows (shared AI workflows) or isolate sessions (separate user conversations) from each other.

OmniRoute, an open-source AI gateway (a tool that connects to multiple AI model providers through one interface), has a critical security flaw in version 3.8.49 and earlier. An attacker can send specially crafted requests to the /api/acp/agents endpoint that bypass security checks and execute arbitrary code (run any commands they want) on the server, especially when login is disabled or during initial setup. The vulnerability exists because the system uses weak filters to block dangerous shell commands and fails to properly authenticate or restrict access to sensitive endpoints.

A vulnerability in MLflow (a platform for managing machine learning workflows) versions 0.0.1 and newer allows attackers to run arbitrary code (unrestricted commands) on a user's computer by creating a malicious model artifact (a saved machine learning model file) that executes when someone loads it into their project.

DocsGPT version 0.15.0 and below has a security flaw in its custom prompt feature that fails to validate user input before processing it with Jinja templates (a system for dynamically generating text). An attacker can inject malicious code into this feature to perform server-side template injection (SSTI, a technique where an attacker tricks the server into executing unintended code), potentially gaining full remote code execution (RCE, the ability to run any command on the server).

FastChat has a security flaw in its /register_worker endpoint (a part of the software that handles worker registration) where attackers don't need to log in to register fake workers that can intercept user data like prompts and responses. Attackers can also use this vulnerability to perform SSRF (server-side request forgery, where they trick the server into making requests to internal networks it shouldn't access) to probe internal network ports.

Copilot Studio has a security flaw where it fails to properly verify cryptographic signatures (mathematical proofs that data comes from a trusted source), allowing an attacker to gain elevated privileges (higher access levels) on a network without authorization.

NLTK's Stanford wrapper classes have a security vulnerability where the `java_options` parameter bypasses validation that was supposed to block dangerous JVM (Java Virtual Machine, the software that runs Java programs) flags like `-agentpath` and `-javaagent`. While a previous fix added validation through the `config_java()` function, the per-call `options` parameter in the `java()` function skips this validation entirely, allowing attackers to inject malicious JVM arguments and execute arbitrary code.