Threats Tagged 'cwe-1427'

Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.

Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-78379 is a critical vulnerability in Amazon Strands Agents Tools prior to version 0.8.5. It involves improper neutralization of input used for large language model (LLM) prompting in the python_repl tool. This flaw allows remote attackers to execute arbitrary Python code on the host running the agent by bypassing the human consent mechanism through a crafted prompt. The issue is mitigated by upgrading to version 0.8.5 or later.

Bulletin ID: 2026-072-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 13:30 PM PDT Description: Strands Agents is an open-source SDK for building AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the shell tool for executing operating system commands on the agent's host. We identified CVE-2026-18733. The shell tool includes a human consent gate that prompts the operator to approve commands before they run. The tool also exposed a non_interactive parameter in the input schema that the large language model (LLM) could control. A crafted prompt, for example one delivered through untrusted content the agent reads (indirect prompt injection), could set non_interactive to true, which bypasses the consent gate and allows arbitrary operating system commands to execute on the agent's host without operator approval. Impacted versions: < 0.8.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.

Eclipse Theia versions prior to 1.71.0 automatically load files matching the pattern .prompts/*.prompttemplate from a workspace, which can override or extend AI agent system prompts. This behavior allows an attacker to craft a malicious repository that replaces the AI's system instructions with attacker-controlled content, leading to indirect prompt injection. Exploitation combined with other AI chat features in untrusted workspaces can result in data exfiltration via Markdown image rendering or arbitrary command execution via task definitions. The vulnerability has a high severity with a CVSS score of 8.4.

Eclipse Theia versions prior to 1.71.0 contain a vulnerability where the AI chat agent improperly neutralizes input used for prompting. Specifically, workspace file and directory names are processed as part of the prompt context without differentiation from system instructions. This flaw allows attackers to craft malicious repositories with adversarial file or directory names that can manipulate the AI agent's behavior, potentially leading to data exfiltration or arbitrary command execution.

MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the use of eval() to evaluate mathematical expressions without proper input sanitization leads to remote code execution. This vulnerability is fixed in 0.1.1.

nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_non_write_users: ${{ github.event.issue.user.login }}, which means any logged-in GitHub user who opens an issue can reach this agentic workflow with attacker-controlled content. Untrusted issue title and body content are embedded directly into the prompt of anthropics/claude-code-action, and the workflow then runs a command-capable Claude agent with permission to comment on and relabel the current issue via gh. Because this workflow is triggered automatically on issues.opened, an external attacker can submit a crafted issue that steers the agent beyond its intended issue-triage purpose and influences authenticated issue actions. This vulnerability is fixed in 2.4.1.

CVE-2026-4399 is a prompt injection vulnerability in the 1millionbot Millie chatbot version 3.6.0. It allows attackers to bypass chat restrictions by crafting inputs that cause the model to execute unintended instructions, potentially revealing prohibited information or performing out-of-context tasks. This vulnerability can lead to abuse of the chatbot service and misuse of associated resources, including OpenAI's API key. The vulnerability has a high severity score of 8.7 but no known exploits in the wild have been reported. No official patch or remediation guidance is currently available.