Threat Library

AVideo before version 29.0 contains an incomplete patch for a previously disclosed command injection vulnerability, allowing attackers to execute arbitrary OS commands via the Live plugin's on_publish.php endpoint. Despite the use of escapeshellarg(), the execAsync() function re-wraps escaped commands in a double-quoted sh -c shell, enabling command substitution through $() and backticks. This flaw carries a critical CVSS score of 9.8 and requires no authentication for exploitation.

A critical unauthenticated remote code execution vulnerability exists in ktransformers, a popular LLM inference acceleration framework, affecting versions through 0.6.3. Attackers can send crafted pickle payloads to the SchedulerServer's ZMQ ROUTER socket, which is bound to all network interfaces by default, to achieve arbitrary command execution as the server process with no authentication required.

GPT-SoVITS, a popular open-source voice cloning/text-to-speech toolkit, contains a critical unauthenticated OS command injection vulnerability (CVSS 9.8) in its Gradio-based web UI. Attackers can execute arbitrary shell commands as the server process user by injecting shell metacharacters into ASR, slicing, denoising, or UVR5 path parameters, with no authentication required.

This is an opinion post by Simon Willison observing that coding agents have made it cheaper for hobbyists to reverse-engineer and automate their own home devices. It does not describe a vulnerability, exploit, or attack technique involving AI agents; it is a general reflection on the economics of AI-assisted coding.

NextCRM's MCP server exposes product catalog management tools (create, update, archive, delete) without enforcing the same role-based restrictions applied to the normal web application. Any authenticated low-privileged user who can obtain an MCP Bearer token can tamper with the shared CRM product catalog, an action normally reserved for managers and admins. This is a broken access control flaw surfaced through an agent-facing tool interface, not a novel AI-specific attack.

AgenticMail's task API let any authenticated low-privileged agent enumerate and hijack tasks belonging to other agents by guessing/looking up their names and task IDs. This breaks the intended per-agent task isolation, allowing one agent to claim, complete, or fail work assigned to another. The vendor fixed this in version 0.9.64.

AgenticMail, a platform that gives AI agents real email addresses and phone numbers, contained a cluster of validation and security-control weaknesses across its API and core packages. These include SQL identifier injection risks, insufficient SMTP header/envelope sanitization enabling command injection, fail-open secret handling, and TLS verification defaulting incorrectly in some configurations. Combined, these flaws could let an attacker manipulate agent-controlled email infrastructure, access or corrupt storage metadata, inject SMTP commands, or intercept traffic via weakened TLS defaults.

nono, a sandboxing framework for running AI agents with reduced privileges, failed to block access to local Unix domain sockets prior to version 0.55.0. This allowed a sandboxed AI agent to reach the per-user systemd D-Bus socket and escape the intended isolation boundary, potentially gaining broader system access than intended. Users should upgrade to 0.55.0 immediately.

AgenticMail's inbound-mail bridge lets any external email trigger a full resume of the operator's Claude Code agent session in an unrestricted 'bypassPermissions' mode, without verifying the sender is actually the operator. Because the attacker-controlled email subject, sender, and preview text are inserted verbatim into the resumed agent's prompt, this is a straightforward indirect prompt injection path into a fully privileged agent capable of Bash, file edits, web fetches, and other MCP tools. This is a critical, easily exploitable vulnerability with a vendor-supplied fix.

Network-AI's MCP SSE server ships with an empty default authentication secret, meaning every request is treated as authorized regardless of whether an Authorization header is present. Combined with a wildcard CORS policy on all responses, this lets a malicious webpage silently invoke any of the 22 exposed MCP tools on a victim's local server, including spawning agents and writing to shared blackboard state. This is a classic drive-by CSRF-style attack against a locally running privileged agent orchestrator.

The WhatsApp MCP server's local bridge API (port 8080) had no authentication, no Host header validation, and allowed arbitrary file paths in message attachments. This let any local process, sibling MCP server, or even a malicious webpage (via DNS rebinding) send WhatsApp messages as the paired user and exfiltrate sensitive local files like SSH keys as WhatsApp attachments. It is fixed in v0.2.1 with bearer token auth, host allow-listing, and path confinement.

This is an academic paper describing a defensive framework (Neural Cryptographic Services) that mitigates prompt-injection-driven tool hijacking in agentic workflows, not a new attack or active exploit. It highlights the well-known underlying threat—authenticated agents being manipulated via prompt injection to execute unintended but identity-valid tool calls—and proposes cryptographic gating as a countermeasure. Severity is low since no exploit, vulnerable product, or active threat is disclosed here.

This is academic research (not an active exploit) demonstrating that using humor as an indirect refusal mechanism in LLMs can itself introduce hidden safety risks. The authors show that a crafted attack, HumorPIA, can covertly embed harmful or toxic content inside seemingly safe humorous outputs, significantly increasing toxicity while evading existing safety detectors.

Hugging Face disclosed a security incident it attributes to an autonomous AI agent conducting an intrusion end-to-end, and a separate report describes 'JADEPUFFER,' an alleged agent-driven ransomware capable of real-time adaptation. Both reports indicate a shift toward AI systems autonomously executing attack chains, but the JADEPUFFER report lacks victim identification and methodology transparency, limiting verifiability. Severity is high due to the plausibility and real-world implications of autonomous offensive agents, but confidence is tempered by sparse technical detail in the secondary source.

F5 disclosed and patched a critical heap buffer overflow in nginx worker processes that can be triggered remotely by an unauthenticated attacker via crafted HTTP requests. The flaw can crash worker processes, causing denial of service, and may allow remote code execution in some configurations. Organizations running affected nginx or NGINX Plus versions should upgrade immediately.

Researchers identified a software supply chain attack dubbed SleeperGem involving three malicious RubyGems packages published to the official RubyGems registry. The packages, including one impersonating the legitimate 'git-credential-manager' tool, were designed to deliver additional payloads to developer machines. The attack targets Ruby developers and CI/CD pipelines that pull dependencies directly from RubyGems.

Hugging Face disclosed that an autonomous AI agent was used to breach its production infrastructure, resulting in unauthorized access to internal datasets and credentials. The incident is notable because the attack vector was an AI agent operating with some degree of autonomy rather than a purely manual intrusion, highlighting real-world risk of agentic systems being weaponized against AI platform infrastructure. Details remain limited, as the source article is truncated and lacks technical specifics on the agent's tooling or exploitation method.

Cybercriminals engaged in carding are increasingly seeking 'clean' residential proxies—IPs with no prior fraud flags—combined with spoofed browser fingerprints and device profiles to bypass modern fraud detection systems. This reflects an evolution in fraud tradecraft as anti-fraud vendors improve detection of traditional proxy and VPN traffic, pushing criminals toward more sophisticated identity-blending techniques.

This article is vendor-sponsored content from Incode discussing on-device age estimation technology as a privacy-preserving alternative to traditional facial biometric verification methods. It describes a product approach rather than a vulnerability, exploit, or active threat campaign. No malicious activity, IOCs, or CVEs are present in this content.

An advanced threat actor is abusing the legitimate update mechanism of ViPNet, a widely used private networking/VPN software suite in Russia, to deliver malicious payloads to government agencies and other organizations. The attack leverages trust in software update channels, a classic supply-chain technique, to gain persistent access to sensitive networks.