Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
92 items
CVE-2026-108456 is an elevation of privilege vulnerability in Azure AI Foundry. Server-side request forgery (SSRF) in the product allows an authorized attacker to elevate privileges over a network.
The Pydantic AI development web chat UI (`Agent.to_web()`, `clai web`) did not check the content type of requests to its chat endpoint. A website visited by a developer could submit a request to the chat UI on that developer's machine, causing the served agent to run and execute its tools with the privileges and credentials of the local process, including tools marked `requires_approval=True`, because the endpoint trusts approval decisions relayed by the client.
Upgrade to a patched version. The chat endpoint now requires `Content-Type: application/json` and rejects other requests before the request body is parsed and before the agent runs. Scripts and other non-browser clients calling the endpoint directly may need to send this header. If you cannot upgrade, don't run the web UI while browsing untrusted sites, stop it when not in use, and don't serve an agent with side-effecting tools through it.
Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder, from version 1.25.1 through 1.34.1 (including the 1.29.1 security-backport release), copy x-ai-capabilities.response_semantics.oauth_card_path into generated API plugin manifests without checking that it is a safe package-relative file reference. An attacker who controls the OpenAPI description can supply parent-directory traversal, rooted paths, or absolute URIs, and a consuming host that resolves the reference may cross the package boundary or use an unintended authentication card. Kiota itself does not read files or execute code during generation.
The GPTranslate WordPress plugin, all versions up to and including 2.34.6, exposes sensitive information through the enqueue_frontend_scripts function (CVE-2026-89278). Unauthenticated attackers can fetch any public page, apply the inverse transformation bundled in the plugin's public JavaScript asset, and recover the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation). The exposure affects the default configuration (gpt-3.5-turbo in client mode) and all supported non-DeepSeek providers, while deepseek-* models and gpt-* models in server-proxy mode suppress key emission.
CVE-2026-85887 is an incorrect permission assignment for a critical resource in M365 Copilot. An authorized attacker can exploit it over a network to disclose information.
CVE-2026-85885 is an improper neutralization of special elements used in a command ('command injection') flaw in M365 Copilot. An authorized attacker can exploit it over a network to elevate privileges.
CVE-2026-78501 is an improper neutralization of special elements used in a command ('command injection') flaw in Microsoft 365 Copilot's Business Chat. An unauthorized attacker can exploit it over a network to disclose information.
Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network. The source gives no affected versions, attack preconditions or further technical detail.
CVE-2026-55946 is an improper neutralization of special elements used in a command ('command injection') flaw in Microsoft Copilot. An unauthorized attacker can exploit it over a network to disclose information.
The winml-cli project's serve/cli_api.py exposes all winml CLI commands over HTTP without authentication and sets allow_origins to a wildcard, so any website can call the localhost endpoint. Combined with the --trust-remote-code flag in the build and config commands, an attacker hosting a malicious model repository can run arbitrary code as the server user. The report's proof of concept demonstrates execution from a cross-origin request.
CVE-2026-81381 describes insufficiently protected credentials in GitHub Copilot and Visual Studio Code. An unauthorized attacker can exploit this over a network to disclose information.
CVE-2026-81380 is a command injection flaw (CWE-77 style wording: improper neutralization of special elements used in a command) affecting GitHub Copilot and Visual Studio Code. An unauthorized attacker can exploit it over a network to disclose information.
CVE-2026-80098 is an improper verification of cryptographic signature flaw in Copilot Studio. An unauthorized attacker can exploit it over a network to elevate privileges.
CVE-2026-58616 is a race condition (CWE-362, improper synchronization of a shared resource) in Copilot Chat in Microsoft Edge. An authorized attacker can exploit it over a network to disclose information.
CVE-2026-69855 is a server-side request forgery (SSRF) flaw in Microsoft Copilot in Azure, classified as CWE-918. An authorized attacker can exploit it over a network to disclose information. The source gives no CVSS score, as NVD has not yet provided an assessment.
CVE-2026-24301, filed under CWE-77, is an improper neutralization of special elements in a command in Microsoft Copilot. Per the source, an unauthorized attacker can disclose information over a network. NVD had not yet provided an assessment at publication, which was 08/18/2026.
CVE-2026-70335 is an OS command injection flaw (CWE-78) in GitHub Copilot and Visual Studio Code. The source says an unauthorized attacker can elevate privileges locally. NVD has not yet provided an assessment, and Microsoft Corporation is listed as the source.
CVE-2026-65675 affects the Visual Studio Code Copilot Chat Extension. The description states that an unauthorized attacker can bypass a security feature over a network. No CWE is assigned for this issue, and NVD had not yet provided an assessment at the time of the source text.
Microsoft Kiota generates AI plugin manifests from OpenAPI descriptions, and the file reference in response_semantics.static_template.file is resolved by the AI host relative to the plugin package. A crafted reference that is percent-encoded, NUL-terminated, or uses Unicode homoglyphs bypassed the IsSafeFileReference check added in v1.32.5, letting paths resolve outside the package. An attacker who controls or tampers with the OpenAPI description could cause inclusion or disclosure of files beyond the package boundary.
Fix: Fixed in the first released Microsoft.OpenApi.Kiota version after 1.33.0, which includes the patches from pull requests 7910 and 7913. Workarounds: only generate from trusted OpenAPI descriptions, and review generated manifests so that response_semantics.static_template.file is a simple relative path within the adaptiveCards/ folder.
CVE-2026-50517 is a deserialization of untrusted data flaw (CWE-502) in M365 Copilot. The source says an authorized attacker can exploit it over a network to execute code. NVD has not yet provided an assessment, and the source lists Microsoft Corporation as the CVE source.
Fix: Upgrade to Kiota 1.35.0 or later and regenerate affected plugin manifests. Kiota 1.35.0 applies the existing safe-file-reference validator to oauth_card_path, drops unsafe references, and emits a warning; valid relative card paths remain supported. Workaround: generate plugins only from trusted, integrity-protected OpenAPI descriptions, and before packaging or deployment review generated manifests and remove any oauth_card_path that is not a safe relative reference confined to the plugin package.