Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.
Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking.
This issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, background synchronization for connected services such as email, Slack, and Notion stores raw external content and later places it in the model context of autonomous background agents without neutralizing embedded instructions. ApprovalGate treats tool calls without an interactive chat context as pre-authorized automation, so attacker-authored content processed during a background tick can influence the model to invoke Composio actions without presenting an approval request. An attacker who can deliver content to a connected account can use this path to send or forward data, post messages, create or modify third-party content, or disclose information from OpenHuman memory and integrations. The issue requires an active integration and successful model interpretation of the injected instructions. This issue is fixed in version 0.57.13.
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or bounding the descriptive fields. The McpRemoteTool records produced by list_tools preserve this remote content, while tool filtering considers the tool name and the prompt-injection detector screens user messages rather than MCP definitions. A malicious or compromised MCP server can therefore return a poisoned description that is evaluated on every agent turn and may direct the model to invoke other available tools, disclose accessible data, or perform unauthorized actions without a separate malicious user message. The issue affects users who configure an attacker-controlled or compromised MCP server. This issue is fixed in version 0.57.13.
CVE-2026-115415 is a vulnerability in Amazon's strands-agents-tools prior to version 0.8.6. It involves improper neutralization of input used for large language model (LLM) prompting in the environment tool, which can allow remote attackers to craft prompts that disable secret masking. This leads to exposure of environment variables in cleartext, including sensitive cloud credentials and API keys. The issue is fixed in version 0.8.6. Users are advised to upgrade and rotate any potentially exposed credentials.
Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards non_interactive_mode as a keyword argument through the batch tool. To remediate this issue, users should upgrade to version 0.8.5 or later.
HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-18733 is a prompt injection vulnerability in the shell tool of Amazon Strands Agents Tools versions before 0.8.0. This flaw allows remote attackers to execute arbitrary operating system commands on the host by crafting a prompt that sets the non_interactive parameter to true, bypassing the human consent mechanism. The issue is resolved in version 0.8.0.
Eclipse Theia versions prior to 1.71.0 automatically load files matching the pattern .prompts/*.prompttemplate from a workspace, which can override or extend AI agent system prompts. This behavior allows an attacker to craft a malicious repository that replaces the AI's system instructions with attacker-controlled content, leading to indirect prompt injection. Exploitation combined with other AI chat features in untrusted workspaces can result in data exfiltration via Markdown image rendering or arbitrary command execution via task definitions. The vulnerability has a high severity with a CVSS score of 8.4.
Eclipse Theia versions prior to 1.71.0 contain a vulnerability where the AI chat agent improperly neutralizes input used for prompting. Specifically, workspace file and directory names are processed as part of the prompt context without differentiation from system instructions. This flaw allows attackers to craft malicious repositories with adversarial file or directory names that can manipulate the AI agent's behavior, potentially leading to data exfiltration or arbitrary command execution.
MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the use of eval() to evaluate mathematical expressions without proper input sanitization leads to remote code execution. This vulnerability is fixed in 0.1.1.
nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_non_write_users: ${{ github.event.issue.user.login }}, which means any logged-in GitHub user who opens an issue can reach this agentic workflow with attacker-controlled content. Untrusted issue title and body content are embedded directly into the prompt of anthropics/claude-code-action, and the workflow then runs a command-capable Claude agent with permission to comment on and relabel the current issue via gh. Because this workflow is triggered automatically on issues.opened, an external attacker can submit a crafted issue that steers the agent beyond its intended issue-triage purpose and influences authenticated issue actions. This vulnerability is fixed in 2.4.1.
CVE-2026-4399 is a prompt injection vulnerability in the 1millionbot Millie chatbot version 3.6.0. It allows attackers to bypass chat restrictions by crafting inputs that cause the model to execute unintended instructions, potentially revealing prohibited information or performing out-of-context tasks. This vulnerability can lead to abuse of the chatbot service and misuse of associated resources, including OpenAI's API key. The vulnerability has a high severity score of 8.7 but no known exploits in the wild have been reported. No official patch or remediation guidance is currently available.
Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentforce Vibes Extension: before 3.2.0.