Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 29

Export CSV
CVE-2026-126767

OpsTree REMS through 1.0.0 Prompt Injection via RCA Chat Assistant

OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hidden system prompt by submitting crafted chat input to POST /api/v1/rca/chat. Attackers can instruct the assistant to ignore its rules and reveal internal orchestration instructions, aiding the crafting of further prompt injection attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-123653

esengine DeepSeek-Reasonix doc.go discoverDocs llm prompting input

A security vulnerability has been detected in esengine DeepSeek-Reasonix up to 2.52.0. Affected is the function discoverDocs of the file internal/memory/doc.go. The manipulation leads to improper neutralization of input used for llm prompting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.53.0 is able to address this issue. The identifier of the patch is 4ca33493a673c2788aa8598fbca2b2f47a69e1b8. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Esengine
Products
Deepseek-reasonix
CVE-2026-106020

LLM Prompting Input Neutralization Failure Leading to Search Order Hijacking

Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking. This issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Easyio Neo Io Manager And Tools Installer
CVE-2026-54140

OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or bounding the descriptive fields. The McpRemoteTool records produced by list_tools preserve this remote content, while tool filtering considers the tool name and the prompt-injection detector screens user messages rather than MCP definitions. A malicious or compromised MCP server can therefore return a poisoned description that is evaluated on every agent turn and may direct the model to invoke other available tools, disclose accessible data, or perform unauthorized actions without a separate malicious user message. The issue affects users who configure an attacker-controlled or compromised MCP server. This issue is fixed in version 0.57.13.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Tinyhumansai
Products
Openhuman
CVE-2026-123498

Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata

Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-102344

Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Kunchenguid
Products
Lavish-axi
CVE-2026-54142

OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, background synchronization for connected services such as email, Slack, and Notion stores raw external content and later places it in the model context of autonomous background agents without neutralizing embedded instructions. ApprovalGate treats tool calls without an interactive chat context as pre-authorized automation, so attacker-authored content processed during a background tick can influence the model to invoke Composio actions without presenting an approval request. An attacker who can deliver content to a connected account can use this path to send or forward data, post messages, create or modify third-party content, or disclose information from OpenHuman memory and integrations. The issue requires an active integration and successful model interpretation of the injected instructions. This issue is fixed in version 0.57.13.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tinyhumansai
Products
Openhuman
CVE-2026-115415

Secret masking bypass in the environment tool in Strands Agents Tools

Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking. To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Amazon
Products
Strands-agents-tools
CVE-2026-77931

MoviePilot 3.1.5 Command Injection via ExecuteCommandTool

MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.

CVSS 4.0 · 8.7 High EPSS 1.0% KEV · Not listed
Vendors
Jxxghp
Products
Moviepilot
CVE-2026-109440

LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Ginlix-ai
Products
Langalpha
CVE-2026-75130

Context7 2.1.2 Prompt Injection via Custom AI Instructions

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instructions to exfiltrate credentials from environment files to an attacker-controlled service and perform destructive file deletion on the victim's machine when the agent makes a routine library documentation request.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Uptash
Products
Context7
CVE-2026-114107

HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hkuds
Products
Vibe-trading
CVE-2026-96893

Improper Neutralization of Input Used for LLM Prompting in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2026-70331

Microsoft Edge for iOS Spoofing Vulnerability

Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Edge Edge Chromium Edge For Ios and 1 more
CVE-2026-78379

Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools

Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards non_interactive_mode as a keyword argument through the batch tool. To remediate this issue, users should upgrade to version 0.8.5 or later.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Amazon
Products
Strands-agents-tools
CVE-2026-21832

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-18733

Prompt injection bypasses shell tool consent gate in Strands Agents Tools

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non_interactive parameter to true, bypassing the human consent gate. To remediate this issue, users should upgrade to version 0.8.0.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Strands-agents-tools Strands Agents Tools
CVE-2026-15077

Improper Neutralization of Input Used for LLM Prompting in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2026-44688

Indirect Prompt Injection in Eclipse Theia AI Chat Leading to Data Exfiltration and Command Execution

In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial directory or file names that, when analyzed by the AI agent, would cause the agent to follow attacker-controlled instructions (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this enabled attack chains leading to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Theia
CVE-2026-46580

Indirect Prompt Template Injection Leading to Remote Code Execution in Eclipse Theia

In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prompt template files that, when the workspace was opened in Theia, replaced the AI's system instructions with attacker-controlled content (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this enabled attack chains leading to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Theia