Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
5 items
Cohere Python SDK versions 5.11.0 through 7.2.0 contain a path traversal (tar slip) flaw in _s3_models_dir_to_tarfile. Its unvalidated tarfile.extractall calls allow arbitrary file writes. An attacker who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.
CVE-2025-61165 affects the /v1/my_drive/batch_upload component of Cohere North AI v1.1.5. The component contains an arbitrary file upload flaw that lets attackers execute arbitrary code by uploading a crafted file.
Cohere North AI v1.1.5 contains an information leak via its WebSocket Endpoint, tracked as CVE-2025-61164. The source does not describe what data is exposed or what precondition an attacker needs.
Cohere North AI v1.1.5 contains an excessively permissive cross-domain policy that accepts untrusted domains. The server does not validate the Origin header of incoming connection requests, which is the root cause.
Incorrect access control in Cohere North AI v1.1.5 lets attackers overwrite user information. A crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint triggers the flaw.