Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
426 items
The AI ChatBot for WooCommerce – WoowBot plugin for WordPress, in all versions up to and including 5.0.0, fails to verify that a user is authorized to perform an action. Authenticated attackers with subscriber-level access or above can repeatedly trigger RAG document sync operations, which issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key. The wp_chatbot nonce needed to reach this endpoint is emitted to every authenticated frontend visitor via wp_localize_script, so any subscriber-level account can obtain it.
ATXP Gemini CLI extension through 1.0.0 has an OS command injection flaw in runAtxp(), which fails to sanitize MCP tool parameters. An attacker can plant instructions in email or SMS content that inject $() or backtick substitutions into parameters such as message_id, subject, or query, running commands as the user.
GitLab fixed a vulnerability in its AI Gateway component, CVE-2026-90970, affecting versions from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. Under certain conditions, an authenticated user with Duo Agent Platform access could escape the prompt template sandbox through a specially crafted flow configuration and execute arbitrary commands on the AI Gateway.
The GPTranslate WordPress plugin, all versions up to and including 2.34.6, exposes sensitive information through the enqueue_frontend_scripts function (CVE-2026-89278). Unauthenticated attackers can fetch any public page, apply the inverse transformation bundled in the plugin's public JavaScript asset, and recover the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation). The exposure affects the default configuration (gpt-3.5-turbo in client mode) and all supported non-DeepSeek providers, while deepseek-* models and gpt-* models in server-proxy mode suppress key emission.
CVE-2026-19407 affects the Google Cloud Gemini Enterprise Agent Platform SDK for Python in versions prior to 1.166.1. The flaw is a bucket squatting issue that allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft.
A Server-Side Request Forgery (SSRF) flaw in Google Cloud Gemini Enterprise Agent Platform App Builder, in versions prior to 2026-06-01 on Google Cloud Platform, lets an unauthenticated attacker leak the Compute Engine default service account access token. The vulnerability was identified as CVE-2026-19486.
Fix: This vulnerability was patched on 01 June 2026. Users will need to redeploy their previously deployed apps.
CVE-2026-13745 affects the Gemini CLI and its associated GitHub Action. An unprivileged attacker could achieve arbitrary code execution in Gemini CLI by placing untrusted local .env files that override GEMINI_CLI_HOME.
NSA, CISA, and FBI issued a joint Cybersecurity Advisory warning that China-based AI companies, including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, are running industrial-scale distillation campaigns against U.S. frontier models such as variants of Claude, GPT, Gemini, and Grok. The companies reportedly extracted billions of tokens across millions of requests since at least late 2024, routing traffic through APIs, cloud providers, third-party aggregators, and proxy "transfer stations" to bypass geographic restrictions and terms of use.
GitLab has remediated a vulnerability in the GitLab AI Gateway component, affecting all versions from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2. An authenticated user with Duo Agent Platform access could redirect model requests to an externally-controlled endpoint via crafted model metadata, which could have disclosed Google Vertex AI or AWS Bedrock cloud service credentials.
CVE-2026-75062 is an Eval Injection flaw (CWE category: Improper Neutralization of Directives in Dynamically Evaluated Code) in the default lf.query Python protocol of Google langfun, affecting versions prior to 0.1.2. Remote unauthenticated attackers can use crafted prompt inputs to make the model generate Python expressions, which are evaluated without a sandbox, letting them execute arbitrary Python code in the context of the host application.
Fix: Fixed in 0.1.2 (langfun versions prior to 0.1.2 are affected).
gemini-bridge's consult_gemini_with_files tool, in inline mode, read any file path given in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, file contents are echoed back through the Gemini round-trip and sent to Google, letting an MCP client or a prompt-injected LLM read any file the server process can access.
Fix: Fixed in 1.3.1. _resolve_path now resolves symlinks and confines paths via Path.relative_to(root), and inline mode skips any entry that resolves outside the working directory. Before upgrading, avoid mode="inline" with untrusted files input, or run the server with a restricted-permission user.
CVE-2026-44187 is a flaw in the Ansible Lightspeed extension for Visual Studio Code. It stores the Google Gemini API key in plain text in the user's configuration file and writes it to output log files, where a local attacker or malware running with the user's privileges can read it. Exploitation can expose the credential and let an attacker consume the user's API quota.
CVE-2026-15610 affects the WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress in all versions up to and including 8.5.6. The plugin does not properly verify that a user is authorized to perform an action, letting authenticated attackers with subscriber-level access and above trigger arbitrary re-embedding of stored RAG documents. This modifies the rag_documents table and consumes the site owner's paid third-party AI API credits (OpenAI, Gemini, OpenRouter, or xAI).
A flaw in the GetSignedGcsUrl RPC of Firebase Studio let authenticated users list buckets and download deployment source code belonging to other tenants. The issue is tracked as CVE-2026-12715 with High severity and was published on 2026-06-24.
No action is required to mitigate this vulnerability as the fix has been deployed to the backend service. As a precaution, users who stored sensitive information, such as API keys (for example, GEMINI_API_KEY), within their Firebase Studio workspace may choose to rotate these keys. For instructions, see the Firebase Studio troubleshooting guide.
CVE-2026-12537 affects Google Gemini CLI (versions prior to 0.39.1) and the run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms. An unprivileged attacker can use a maliciously crafted .gemini/.env file to achieve pre-sandbox host-level code execution, via an OS command injection flaw in the container launcher. NVD has not yet provided an assessment; the CNA GoogleCloud rates it CVSS 4.0 10.0 CRITICAL.
Fix: Fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22, the versions after which the flaw is no longer present. The source text does not describe further workarounds; the advisory is referenced at https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g.
Keras versions prior to 3.14.0 contain a path traversal flaw in the archive extraction utilities in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` check archive member paths against the process current working directory instead of the extraction destination, so when the working directory is `/`, as is common in Docker containers, CI/CD runners and Jupyter environments, traversal paths bypass the check. An attacker can cause arbitrary file writes outside the extraction directory, enabling overwrites of configuration files, malicious code injection or corruption of machine learning datasets and pipelines.
The first-party PraisonAI A2A server example combines three behaviors into a remotely exploitable chain: it exposes an A2A server without `auth_token`, binds to `0.0.0.0`, and registers a `calculate(expression)` tool implemented with Python `eval(expression)`. An unauthenticated client can send a JSON-RPC `message/send` request to `/a2a`, which passes the message to `agent.chat()`, and with a real Gemini model the LLM invoked `calculate`, executing Python in the server process. The advisory says the chain is confirmed for the official example and deployments following the same pattern, and that the full chain is only claimed for versions where the `/a2a` endpoint is present and confirmed.
The Keras model loader, KerasFileEditor, reads HDF5 weight files inside user-supplied .keras archives without validating dataset metadata. A crafted model.weights.h5 declaring a dataset shape of (50000000, 50000000) with only a few bytes of stored data triggers a full-shape allocation via value[()] in h5py, producing an attempted 8.88 PiB allocation that crashes the process. The advisory describes the impact as denial of service for any environment or pipeline that loads untrusted .keras models.
Gemini CLI (`@google/gemini-cli`) and the `run-gemini-cli` GitHub Action are updated to harden workspace trust and tool allowlisting, especially in untrusted environments such as GitHub Actions. In headless mode, earlier versions automatically trusted workspace folders, so malicious environment variables in a local `.gemini/` directory could lead to remote code execution, and under `--yolo` the fine-grained tool allowlist in `~/.gemini/settings.json` was ignored. The update requires explicit folder trust and makes the policy engine evaluate tool allowlisting under `--yolo` (version `0.39.1`), which can break existing CI/CD workflows.
CVE-2026-1462 affects the `TFSMLayer` class in the `keras` package, version 3.13.0. Attacker-controlled TensorFlow SavedModels load during deserialization of `.keras` models even when `safe_mode=True`, bypassing that protection. The result is arbitrary code execution during model inference under the victim's privileges, caused by unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and missing validation in `from_config()`.
Fix: The authoring agencies recommend U.S. AI companies implement comprehensive detection and mitigation, monitoring anomalous prompts, accounts, networks, and behaviors, including subscription-to-usage ratios, maximum usage from new accounts, and enterprise-scale throughput patterns. They also recommend deploying targeted response changes, subtly altering responses for suspected malicious distillation attempts to reduce the payoff to attackers. The source lists a third immediate action that is not shown in the excerpt.
CISA Cybersecurity AdvisoriesFix: Fixed in 3.14.0.
Fix: The folder trust and tool allowlisting mitigations are available in `@google/gemini-cli` version `0.39.1` and `0.40.0-preview.3`. Users must review their workflows and take one of two approaches: 1. If the workflow runs on trusted inputs, set `GEMINI_TRUST_WORKSPACE: 'true'` in the workflow. 2. If the workflow runs on untrusted inputs, review the guidance in google-github-actions/run-gemini-cli to harden the workflow against malicious content, and set the environment variable. If the workflow specifies a version via `gemini_cli_version`, upgrade to one of the patched versions and audit the workflow settings that use Gemini CLI.
GitHub Advisory Database