Prompt injection and jailbreaks

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object, which evaluates untrusted language model output derived from web page content. Attackers can use indirect prompt injection through web pages to inject malicious Python code that runs on the operator's host without review.

The Continue CLI relies on an incomplete denylist as its only barrier to destructive shell commands in headless and auto mode, where the default policy grants the Bash tool allow permission. The critical-command check blocks only a small set of root and system paths, so recursive forced removal of directories such as /home or /root, and $HOME expansion, pass through. An indirect prompt injection in content the agent reads, such as web pages, repository files or issue text, can cause an unattended run to destroy the invoking user's data.

Amazon Strands Agents Tools before 0.8.0 contains a prompt injection vulnerability in its shell tool. A crafted prompt that sets the non_interactive parameter to true bypasses the human consent gate, allowing remote actors to execute arbitrary operating system commands on the agent's host. The CNA, AMZN, rates it CVSS 4.0 7.5 (HIGH), and NVD has not yet provided an assessment.

CVE-2026-18733 affects the shell tool in the strands-agents-tools package for Strands Agents, an open-source SDK for building AI agents, in versions below 0.8.0. The tool's input schema exposed a non_interactive parameter that the LLM could control, so a crafted prompt, including one delivered through untrusted content the agent reads, could set it to true. This bypasses the operator consent gate and allows arbitrary operating system commands to run on the agent's host without approval.

CVE-2026-18655 is an improper restriction of intended endpoints in the RabbitMQ broker connection tools of the AWS Labs Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before 2.0.24, affecting versions <= 2.0.23. A remote unauthenticated actor may obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens by sending them to a crafted endpoint controlled through a broker hostname introduced in the MCP client context.

PraisonAI versions before 4.6.78 default the prompt injection defense block threshold to CRITICAL severity, so HIGH-level threats pass through unblocked. Attackers can submit single-vector prompt injections, such as instruction overrides or financial manipulation, that are detected at HIGH severity and logged without being blocked, enabling system prompt extraction and unauthorized tool invocations. VulnCheck rates the issue CVSS 4.0 8.7 HIGH, and NVD has not yet provided an assessment.

CVE-2026-14898 affects the OpenAI Codex desktop app for macOS, which rendered remote images from Markdown in model responses. An attacker who planted an indirect prompt injection in content Codex processed could make the model build a remote image URL carrying sensitive data, and the app fetched that URL automatically during rendering, sending the data to an attacker-controlled server without a user click. Exploitation could expose API keys, source code, and data returned by connected tools, though no integrity or availability impact was demonstrated and no exploitation in the wild is known.

A vulnerability in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0 could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests. The weakness is classified as CWE-20, Improper Input Validation, and NVD has not yet provided an assessment.

AWS published bulletin AWS-2025-019 on prompt injection issues in Amazon Q Developer and Kiro, reported in Embrace The Red's "The Month of AI Bugs" blog posts. The Amazon Q Developer flaws, affecting find, grep and echo commands (versions below 1.22.0) and ping and dig commands (versions below 1.24.0), could run commands or exfiltrate metadata via DNS without Human-in-the-Loop confirmation. The Kiro flaw requires local system access and can lead to arbitrary code execution via IDE or MCP settings files, in Autopilot or Supervised mode, affecting version 0.1.42.

k8sGPT's auto-remediation pipeline deserializes AI-generated YAML directly into a Deployment object in `object_to_execution.go`, without validating it against the original Deployment object. The issue was fixed after coordination with Alex Jones, and the proof of concept was shared only with the maintainers.