AI/LLM intel briefing: 25 critical RCE flaws, May-June 2026

Dear friends and colleagues,

This past month brought an unprecedented wave of critical vulnerabilities across the AI tooling ecosystem, with remote code execution flaws dominating the landscape. I count at least 25 critical-severity vulnerabilities disclosed between May 23 and June 22, affecting everything from enterprise AI platforms to open-source agent frameworks. What concerns me most is how many of these bugs stem from the same architectural mistake: trusting user input in contexts where isolation was assumed but never enforced.

The authentication bypass epidemic

A cluster of authentication failures revealed how fragile access control has become in AI infrastructure. LiteLLM's proxy allowed attackers to bypass authentication entirely through crafted Host headers, while vLLM's OpenAI API protection suffered an identical flaw. Both vulnerabilities exploited the same weakness: checking the wrong URL path when special characters appeared in HTTP headers. Network-AI compounded this problem by shipping an incomplete fix for CVE-2026-46701, leaving servers with empty default secrets that accepted all requests without credentials. The pattern repeats across the stack: SillyTavern trusted Remote-User headers from single sign-on systems without verifying their source, PraisonAI deployed Flask servers with authentication disabled by default, and GitLab's MCP Server exposed unauthenticated browser-control endpoints to all network interfaces. These aren't edge cases. They represent systematic failures to validate identity at security boundaries.

File handling as an attack surface

File operations emerged as the month's most dangerous primitive. Langflow's BaseFileComponent allowed attackers to read arbitrary files through symlinks hidden in compressed archives, then steal JWT secrets to forge authentication tokens and achieve RCE through the Python Interpreter node. The same platform permitted unlimited unauthenticated file uploads that could exhaust disk space while leaking exact storage paths. PraisonAI's multiedit tool bypassed all path validation by passing filepaths directly to Python's open() function, allowing agents to read SSH keys or overwrite system files. LangSmith SDK's TracingMiddleware combined missing header validation with type-checking failures to enable arbitrary file reads that could be uploaded to LangSmith workspaces. The underlying problem is consistent: developers treat file paths as trusted data when they originate from untrusted contexts like AI-generated tool calls or user-supplied workflow configurations.

Command injection through the shell

Shell command construction proved catastrophic across multiple platforms. Network-AI's wildcard allowlist permitted rules like git * but then executed commands through /bin/sh -c, letting attackers append malicious commands with semicolons and pipes. Agentic-flow's MCP server tools directly interpolated user parameters into shell commands via execSync, enabling arbitrary OS command injection. Agent-coderag automatically executed Gradle wrapper scripts from untrusted repositories during dependency discovery, requiring no authentication. AWS Bedrock AgentCore's install_packages() failed to neutralize argument delimiters, allowing attackers to inject flags like --index-url to redirect package downloads or -r to read sandbox files. These vulnerabilities share a common root: concatenating untrusted input into strings that are later parsed as executable commands, rather than using parameterized execution that treats arguments as data rather than code.

Sandbox escapes and privilege escalation

The sandboxes designed to isolate AI execution routinely failed this month. PraisonAI's execute_code() function allowed sandbox escape through four distinct gaps: the __self__ attribute retrieved the real builtins module, vars() wasn't restricted, attribute-based function calls bypassed checks, and string concatenation evaded constant filters. Flowise's function nodes let users submit JavaScript that could break out of E2B sandboxes when the E2B_APIKEY wasn't configured. Ouroboros-ai's incomplete CVE-2026-47211 fix still allowed malicious project .env files to enable RCE through omitted environment variable names in the denylist, while auto-loading configuration from working directories without trust verification. Meanwhile, n8n suffered prototype pollution through its Microsoft SQL node, where crafted table parameters could modify the base object all objects inherit from, causing validation failures across the entire application. I think the lesson here is uncomfortable: runtime sandboxing in languages like Python and JavaScript offers weaker isolation than we want to admit, particularly when the sandbox relies on blocklists rather than allowlists of permitted operations.

Supply chain compromises and infrastructure attacks

Two supply chain incidents demonstrated how npm credential theft translates to ecosystem-wide compromise. Microsoft attributed the Mastra AI attack to North Korea's Sapphire Sleet group, which compromised a maintainer account to publish malicious updates across over 140 packages, injecting a fake dependency that stole credentials and cryptocurrency wallet data through post-install hooks. The TanStack incident saw attackers publish malicious versions under the trusted TanStack identity, potentially distributing credential-stealing malware; CISA added this to the Known Exploited Vulnerabilities catalog, confirming active exploitation. Codexui-android suffered a similar fate, with attackers embedding token-stealing code that exfiltrated refresh_token credentials that never expire. Google Cloud's Vertex AI SDK had a bucket-squatting vulnerability in versions 1.139.0 and 1.140.0, where predictable storage bucket names let attackers intercept model uploads and inject malicious code. What unites these incidents is the brittleness of trust in package ecosystems: a single compromised credential cascades across hundreds of downstream dependencies.

Vulnerabilities in production AI systems

Several production deployments revealed critical flaws in flagship AI products. Microsoft 365 Copilot's SearchLeak vulnerability (CVE-2026-42824) chained parameter-to-prompt injection, an HTML rendering race condition, and SSRF in Bing to steal emails, passwords, and documents through a single malicious link. LiteLLM's vulnerability chain earned a CVSS score of 9.9 by combining authorization bypass (CVE-2026-47101), privilege escalation (CVE-2026-47102), and sandbox escape (CVE-2026-40217) to let low-privilege users gain admin control and execute code, exposing all provider API keys and allowing man-in-the-middle manipulation of AI responses. Crawl4AI's Docker API bundled seven critical vulnerabilities including arbitrary file writes, SSRF, authentication bypass, stored XSS, and a hardcoded JWT secret. Langflow's shareable playgrounds allowed unauthenticated RCE by modifying the code field in API requests to /api/v1/build_public_tmp. These aren't research prototypes; they're tools used in production environments where a single exploited vulnerability can compromise entire organizations.

Cross-cutting patterns and forward implications

Looking across this month's disclosures, I see three structural problems that require architectural rethinking rather than tactical patches. First, the boundary between "user input" and "trusted configuration" has collapsed in AI systems where models generate tool calls, workflow parameters, and code that later executes with elevated privileges. Second, sandboxing strategies that worked for traditional applications fail when applied to AI agents that need access to files, networks, and execution primitives to perform their core functions. Third, authentication and authorization checks designed for human users don't map cleanly to AI-driven automation where the "user" is often a model acting on behalf of someone who initiated a workflow hours earlier. The fixes this month focused on input validation, allowlists, and explicit authentication checks, but we need to acknowledge that these are defensive measures against a fundamentally adversarial execution model where untrusted code generation is the feature, not the bug.

I expect June's vulnerability count to look similar unless we see meaningful shifts toward capability-based security models, where tools receive only the specific permissions they need rather than inheriting ambient authority from their execution context. Until then, stay vigilant and patch aggressively.

For the full dataset and daily updates, visit AI Sec Watch.

— Jack