Prompt injection and jailbreaks

Cursor, an AI-assisted code editor, allows writing files inside the workspace without user approval in versions below 1.3.9. Approval is required to edit an existing dotfile but not to create a new one, so when a sensitive file such as .cursor/mcp.json does not yet exist, an attacker can chain an indirect prompt injection to hijack the context, write the settings file, and trigger RCE on the victim without approval.

Cursor, an AI-assisted code editor, allows in-workspace file writes without user approval in versions less than 1.3.9. Creating a new dotfile does not require approval, even though editing an existing one does. If files such as .vscode/settings.json do not already exist, an attacker can chain an indirect prompt injection to hijack the context, write the settings file, and trigger RCE on the victim without approval.

@cyanheads/git-mcp-server, an MCP server for Git repositories, prior to version 2.1.5 has a command injection flaw. Unsanitized input parameters are passed into a child_process.exec call, so an attacker can inject shell metacharacters such as |, >, and && to run arbitrary system commands with the server process's privileges, potentially leading to remote code execution. An MCP client can also be steered into this through indirect prompt injection when asked to read git logs.

CVE-2024-48142 describes a prompt injection vulnerability in the chatbox of Butterfly Effect Limited's Monica ChatGPT AI Assistant v2.4.0. A crafted message allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant. The NVD had not yet provided an assessment, and the weakness is mapped to CWE-77.

CVE-2024-48140 describes a prompt injection vulnerability in the chatbox of Butterfly Effect Limited's Monica Your AI Copilot powered by ChatGPT4, version 6.3.0. A crafted message lets an attacker access and exfiltrate all previous and subsequent chat data between the user and the AI assistant. The source lists CWE-77 (Command Injection) as the weakness, and NVD has not yet provided an assessment.

CVE-2024-48141 is a prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0. A crafted message lets an attacker access and exfiltrate all previous and subsequent chat data between the user and the AI assistant. The weakness is catalogued as CWE-77, Improper Neutralization of Special Elements used in a Command ('Command Injection'), and NVD published the entry on 10/24/2024.

CVE-2024-48139 is a prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95. A crafted message lets an attacker access and exfiltrate all previous and subsequent chat data between the user and the AI assistant. The NVD assessment has not yet been provided, and the source maps the weakness to CWE-77 (Command Injection).

CVE-2023-32786 affects Langchain through 0.0.155. Prompt injection in that version allows an attacker to force the service to retrieve data from an arbitrary URL, which the source describes as providing SSRF and potentially injecting content into downstream tasks. NIST has not yet provided an NVD assessment.