Prompt injection and jailbreaks

The local HTTP server started by `engram server` (default `127.0.0.1:7337`) accepted requests from any browser origin with no authentication unless `ENGRAM_API_TOKEN` was set. Combined with `Access-Control-Allow-Origin: *` and a body parser that did not require `Content-Type: application/json`, a malicious web page could read the knowledge graph via `GET /query` and `GET /stats`, and write persistent prompt-injection payloads via `POST /learn`, which were later surfaced to the user's AI coding agent. Affected versions are `engramx` >= 1.0.0 and < 2.0.2.

FlowiseAI's POST and GET API Chain components build request URLs from LLM output without validating them against the intended API documentation. Unauthenticated attackers can inject a crafted documentation prompt that overrides the BASE URL, causing the server to send arbitrary HTTP requests to internal and external hosts, as demonstrated against /flag on host.docker.internal:8080. The source affects FlowiseAI instances at version 2.2.1 and below.

GHSA-44c2-3rw4-5gvh reports an SSRF flaw in FileTools.download_file() in praisonaiagents. The function checks the destination path but passes the caller-supplied url directly to httpx.stream() with follow_redirects=True, so an attacker who controls the URL can reach any host the server can access, including cloud metadata services and internal services. On EC2 instances with IMDSv1 enabled, IAM credentials can be retrieved and written to disk, and the flaw is reachable through indirect prompt injection without authentication.

PraisonAI's `run_python()` in `praisonai` builds a shell command by placing user-controlled code inside `python3 -c "<code>"` and runs it with `subprocess.run(..., shell=True)`. Its escaping only handles `\` and `"`, so `$()` and backtick substitutions execute as OS commands before Python starts, enabling arbitrary command execution as the process user. The advisory notes the function is reachable through indirect prompt injection, and the auto-generated Flask server ships with `AUTH_ENABLED = False` when no token is configured.

CVE-2026-4399 is a prompt injection vulnerability in the 1millionbot Millie chatbot. A user can evade chat restrictions with Boolean prompt injection, phrasing a question so that an affirmative ('true') reply causes the model to execute the injected instruction. A remote attacker could then obtain prohibited or out-of-context information, use 1millionbot's resources or OpenAI's API key for unintended tasks, and bypass restrictions set during model training.

CVE-2026-33654 affects nanobot, a personal AI assistant, prior to version 0.1.6. An indirect prompt injection flaw in the email channel processing module (`nanobot/channels/email.py`) lets a remote, unauthenticated attacker run arbitrary LLM instructions, and then system tools, by sending an email to the bot's monitored address. The bot polls and processes that content as highly trusted input, bypassing channel isolation, so the attack needs no action from the bot owner.

CVE-2025-64108 affects Cursor, a code editor built for programming with AI, in versions 1.7.44 and below. Various NTFS path quirks let a prompt injection attacker bypass sensitive file protections and overwrite files that Cursor normally requires human approval to overwrite. Modifying some of these protected files can lead to RCE, and the issue must be chained with a prompt injection or malicious model attack and only affects systems supporting NTFS.

CVE-2025-62356 is a path traversal vulnerability in all versions of the Qodo Qodo Gen IDE, classified as CWE-22. A threat actor can read arbitrary local files in and outside of current projects on an end user's system. The vulnerability can be reached directly and through indirect prompt injection.