Skip to content

Translation in progress Some entries still include text in the original language.

AI software vulnerabilities · News

Oct 14 · Wednesday

AI software vulnerabilities · News

Latest publications and developments
AI software vulnerabilities

Research topics

Prompt injectionAgent safetyDeception and schemingReward hackingInterpretabilityMonitoring and AI controlBackdoors and poisoning隐私与数据泄露Children, teens and mental healthSupply-chain securityDangerous capabilitiesAI 与网络攻防Open models and weight securityRed teaming and challenges

Companies and institutions

OpenAIAnthropicGoogle DeepMindGoogle 安全MetaxAIMicrosoftNVIDIADeepSeek阿里巴巴 · Qwen智谱 · GLM月之暗面 · Kimi腾讯UK AISIUS CAISIMETRRedwood ResearchFAR.AI

Reports and frameworks

System CardAI software vulnerabilitiesFrontier safety frameworks
TodayOct 14Wed
  1. The Hacker NewsThe Hacker News · 46

    GitHub tightens npm publishing configuration to prevent package hijacking

    In October 2026, GitHub tightened the npm trusted publishing mechanism: newly created trusted publishing configurations expire if they do not complete a first successful publish within 48 hours. This move targets the vulnerability SlugFest discovered by Bloom Security, where attackers can claim repository slugs that maintainers have renamed, transferred, or deleted, inheriting their trust relationships and thereby publishing malicious versions under legitimate package names. The researchers found more than 1,500 affected packages with a combined download count exceeding 10 million, and reported this to GitHub on June 6, 2026.

Oct 13Tue
  1. Check Point ResearchCheck Point Research · 64

    LiteLLM gateway exposes multiple high-severity vulnerabilities

    Check Point Research's security assessment of the open-source LLM gateway LiteLLM 1.77.7 found multiple high-severity vulnerabilities. The core issue is that the /config/update endpoint lacks role-based authorization checks, allowing any logged-in user (including low-privilege Internal Users) to modify the proxy's runtime configuration, and thereby read arbitrary files by injecting the UI_LOGO_PATH environment variable, and take over the admin interface by overwriting UI_USERNAME and UI_PASSWORD. The related vulnerabilities were fixed in LiteLLM version 1.83.9.

Oct 12Mon
  1. NIST NVDNIST NVD · 57

    agno framework discloses multiple command injection and missing authentication CVEs

    NVD registered 5 new CVEs for agno (agno-agi) on October 12, covering CodingTools command injection, PythonTools code injection, AgentOS missing default authentication, orchestration layer dynamic code execution, and excessive team delegation privileges. Among them, CodingTools.run_shell command injection is CVE-2026-108817, affecting versions 3.0.9 and earlier, with a CVSS 3.1 score of 5.5. The official statement says upgrading to 3.0.10 or commit ed64fab fixes it.

  2. GitLab, The Hacker NewsGitLab · 2 sources · 2 reports · ↑158

    GitLab fixes Duo Agent prompt injection and a CVSS 10.0 vulnerability

    GitLab released patch versions 19.4.2, 19.3.5, and 19.2.8 on October 12, 2026, fixing multiple security issues. Among them, the Duo Agent Platform prompt injection vulnerability CVE-2026-96893 has a CVSS score of 7.3; authenticated users can inject specially crafted content into AI agent instructions, potentially leading to execution of unintended commands on behalf of other users. Affected versions include GitLab EE from 19.1 up to before 19.2.8, from 19.3 up to before 19.3.5, and others. The same update also fixed the highest-severity vulnerability CVE-2026-97229 with a CVSS score of 10.0: due to insufficient regex validation, unauthenticated users can execute arbitrary code on the GitLab server via specially crafted regular expressions in CI/CD configuration. Earlier versions of 19.2, 19.3, and 19.4 are affected. Additionally, CVE-2026-92883 (8.7, cross-site scripting) and CVE-2026-16301 (8.5, improper authorization in downstream pipelines) were also fixed.

  3. OpenCVEOpenCVE · 38

    Ollama Pull API has SSRF vulnerability CVE-2026-108836

    Ollama 0.34.1 and earlier versions have a server-side request forgery (SSRF) vulnerability in the Pull API, located in the IsValid function in types/model/name.go, which mishandles model names. A remote attacker can craft API calls to make the server send requests to arbitrary URLs, thereby exfiltrating data or accessing internal services. The vulnerability is numbered CVE-2026-108836, with a CVSS v4.0 score of 6.9 (medium) and a v3.1 score of 7.3, and exploit code has been publicly disclosed. Upgrading to 0.34.2 fixes it.

  4. 腾讯朱雀实验室腾讯朱雀实验室 · 44

    Tencent Zhuque discloses Linux vhost kernel vulnerability CVE-2026-74580

    腾讯朱雀实验室披露，Corvus AI 在 Linux vhost 虚拟化加速子系统中发现高危内存安全漏洞 CVE-2026-74580，CVSS 评分 8.8，影响 Linux 4.11 至 7.2 之间近十年内核版本，以及 Ubuntu、RHEL、Amazon Linux、Azure Linux、Oracle Linux 等主流发行版。漏洞源于 vq->meta_iotlb[] 元数据缓存未在 VHOST_SET_VRING_ADDR 路径失效，可构造确定性利用，存在从本地提权到虚拟机逃逸的风险。

Oct 11Sun
  1. HackMDHackMD · 47

    hyper-mcp Cosign verification bypassable, involving two CVEs

    Security researcher hieuPenguinnn disclosed that the Rust-written MCP server hyper-mcp has a TOCTOU race condition when loading WebAssembly plugins from an OCI registry, allowing Cosign signature verification to be bypassed. load_wasm uses the parsed manifest digest only as a cache key, but passes the mutable tag to cosign verify, and determines success solely by the process exit code, never comparing the digest actually verified by Cosign; the default identity policy also sets ident to a wildcard, further loosening verification. This issue involves two CVEs.

  2. VulnCheckVulnCheck · 38

    BotSharp hardcoded JWT key leads to authentication bypass

    BotSharp 5.2.0 and earlier versions have an authentication bypass vulnerability. According to VulnCheck, an unauthenticated remote attacker can exploit the hardcoded Jwt:Key in the WebStarter appsettings.json to forge a bearer token, impersonating any known user, including an administrator, to access API routes protected by Authorize. An attacker can sign a token using the committed HMAC key and the fixed botsharp issuer and audience.

Oct 10Sat
  1. NIST NVDNIST NVD · 56

    Argo CD MCP path traversal can delete repository clusters

    In argoproj-labs' Argo CD MCP Server (argocd-mcp) version 0.9.0 and earlier, the delete_application tool does not validate applicationName, leading to a path traversal issue. An attacker or a prompt-injected model can pass path segments like ../repositories/ to send DELETE requests to other Argo CD APIs using the MCP's authenticated token, deleting repositories, clusters, or projects within the token's RBAC scope. NVD has registered it as a CVE.

  2. NIST NVDNIST NVD · 37

    open-multi-agent tool sandbox symlink escape vulnerability

    NVD published CVE-2026-108600, noting that open-multi-agent's file write tool can write files outside the workspace via dangling symbolic links. According to VulnCheck's advisory, affected versions are 1.5.0 through 1.21.2. The NVD page references list the relevant code locations in file-write.ts and path-safety.ts in the repository, as well as a HackMD vulnerability analysis.

  3. NIST NVDNIST NVD · 54

    phi-coded agent symlink bypasses write sandbox

    NVD has cataloged CVE-2026-108599, pointing to a symlink bypass of workspace write sandboxing in the phi-coded Agent. The record links to two code locations in the pulseaiclub/phi repository, internal/permission/gate.go and internal/tools/writetool/write.go, and cites a VulnCheck advisory titled phi 0.1.1 through 0.28.4 symlink workspace write restriction bypass.

  4. VulnCheck · 29

    JeecgBoot 3.9.5 and earlier versions have a missing authorization vulnerability in /airag/airagMcp/queryById

    JeecgBoot 3.9.5 and earlier versions have a missing authorization vulnerability (CWE-862, CVSS 7.1), allowing any authenticated user to read MCP server configurations. Because the permission check in queryById is commented out, an attacker can first obtain record IDs from the unprotected /airag/app/queryById endpoint, then use them to obtain MCP endpoint URLs, request headers, and outbound authentication tokens.

  5. The Hacker NewsThe Hacker News · 32

    DarkSword iOS exploit kit new variant P7 exposed

    iVerify discloses a new variant of the DarkSword iOS exploit kit, P7 DarkSword, which adds on-device keychain and encrypted wallet data theft and supports bidirectional C2 communication with attacker infrastructure. The implant injects into the SpringBoard process, polls for commands every 15 seconds, can execute system commands, upload photos and Apple Notes data, and targets imToken wallets for data extraction. The kit has previously been used in attacks against Saudi Arabia, Turkey, Malaysia, and Ukraine.

Oct 9Fri
  1. Tenable®Tenable® · 55

    Tenable discloses PKCE vulnerability in Hermes Agent login

    Tenable disclosed a PKCE vulnerability in the Hermes Agent GET /auth/native/authorize login flow that can lead to full takeover of a victim's account session. The flow uses Python's urllib.parse.urlparse to validate redirect_uri but returns the unnormalized raw value to the browser; because the Python parser and the browser's WHATWG parser handle backslashes differently, the server believes the redirect target is the loopback address 127.0.0.1, while the browser redirects to an attacker-controlled target.

  2. XRPL.org · 43

    xrpld 3.4.1 vulnerability disclosure report

    XRPL published the vulnerability disclosure report for xrpld 3.4.1, describing the two vulnerabilities fixed in that version. The first is a missing validation for wrapping internal transactions in a Batch—the server did not check whether the inner transaction was wrapped in the RawTransaction field, which could cause different node versions to disagree on whether the same transaction is valid; the fix was enabled on Mainnet on 2026-10-09 in the form of the fixBatchV1_2 amendment. The second is a 64-bit integer overflow in the payment engine, where an attacker could mint XRP out of thin air using hundreds of offers plus one payment; this flaw has existed since the payment engine was written in 2015, and the fix shipped with 3.4.1 on 2026-09-25 and took effect immediately, without going through the amendment process. The report states that no exploitation of this vulnerability was found on any public network.

  3. GitHub 安全公告GitHub 安全公告 · 43

    PraisonAI AICoder 组件任意文件写入与命令执行漏洞

    GitHub 安全公告披露，PraisonAI 的 AICoder UI 组件向 LLM 暴露 write_to_file 和 execute_command 两个工具。前者缺少路径校验，os.path.join 无法阻止绝对路径，可写入 /root/.ssh/authorized_keys、/etc/crontab 等任意位置；后者没有命令清洗、白名单或沙箱。攻击者可通过聊天界面的提示注入触发这两项工具，导致任意文件写入与命令执行。

  4. GitHub 安全公告GitHub 安全公告 · 43

    PraisonAI MCP HTTP-stream 默认无认证漏洞

    GitHub 安全公告指出，PraisonAI 4.6.63 的 MCP HTTP-stream 服务仅在配置 API key 时才鉴权，而 CLI 的 --api-key 默认为 None，因此执行 praisonai mcp serve --transport http-stream 后整个 MCP 接口处于未鉴权状态。无 Authorization 且无 Origin 头的请求可以完成 initialize 并拿到 mcp-session-id，进而暴露工具枚举与未校验的工具调用面。

  5. GitHub 安全公告GitHub 安全公告 · 50

    LangChain MongoDB 会话历史查询注入漏洞

    LangChain 的 MongoDBChatMessageHistory 组件未在运行时强制校验会话标识符的字符串类型，结构化会话标识符可能被当作 MongoDB 查询条件而非字面标识符执行。当应用把不可信的会话标识符输入传给该组件、且在同一集合中存储多个用户的历史记录时，攻击者可读取、修改或删除其他用户存储的对话。该问题已在 @langchain/mongodb 1.3.1 版本修复，补丁在运行时校验会话标识符并确保其以字面值参与查询。

  6. GitHub 安全公告GitHub 安全公告 · 2 reports · 52

    Pydantic AI Web 聊天 UI 存在 CSRF 与 DNS 重绑定漏洞

    Pydantic AI 的开发用 Web 聊天 UI（Agent.to_web()、clai web）被披露存在两项安全问题。其一，聊天端点未校验请求内容类型，开发者访问的网站可向本机运行的聊天 UI 提交请求，使被服务的 Agent 运行并以本地进程的权限和凭据执行其工具；默认绑定 localhost 无法阻止，因为浏览器中打开的页面可以访问回环地址。其二，该 UI 未校验 Host 头，攻击者控制的域名解析到回环地址后，浏览器会将其视为同源，从而让 Agent 以本地进程权限运行并执行工具。影响范围包括通过 Agent.to_web() 或 clai web 提供 Agent 的应用和开发者，后果取决于 Agent 暴露的工具，可能包括数据泄露和意外的工具副作用。

  7. GitHub 安全公告GitHub 安全公告 · 3 reports · 50

    Pydantic AI web_fetch 资源耗用与无界内存漏洞

    Pydantic AI 的本地网页抓取工具 web_fetch_tool（也是 WebFetch 能力的本地回退）被披露存在多项问题。公告称，标题提取使用回溯正则匹配原始响应体，重复未闭合标签开头会让耗时随体积平方增长，该二次复杂度步骤运行在 event loop 上，可被引导抓取攻击者控制的页面，阻塞 event loop 数分钟，拖住进程内其他协程。远程内容下载路径在施加任何大小限制前会把整个 HTTP 响应体缓冲进内存，可被诱导抓取大体积 URL，耗尽进程内存并导致 worker 崩溃；FileUrl 媒体下载（ImageUrl、DocumentUrl、VideoUrl、AudioUrl）存在同样的无界缓冲问题。另有公告称，转换攻击者可控的 HTML 时会出现过高 CPU 和内存占用：嵌套块级元素会让 HTML 转 Markdown 逐层重复处理累积文本并使中间输出膨胀，响应体大小限制只约束下载字节数，返回内容限制在转换之后才生效；当前版本把转换放在工作线程中执行，仍可能消耗大量资源并拖慢同进程内其他任务，更早版本则在事件循环上执行转换。

    Latest developments

    1. Pydantic AI 远程内容下载无界内存漏洞

    2. Pydantic AI web_fetch 存在二次复杂度阻塞事件循环漏洞