From 70048b06759098fafaeef619274dd5a3b90578a6 Mon Sep 17 00:00:00 2001 From: emmanuelgjr Date: Wed, 30 Sep 2026 23:03:13 -0400 Subject: [PATCH 1/2] incidents: add INC-138..INC-148, eleven GenAI tooling CVEs Eleven published CVEs in GenAI tooling, each with a named affected version, a maintainer advisory and a fix release: three in LMDeploy (two pickle deserialisation RCEs, one eval() of a model config value), three in vLLM (two multimodal resource-exhaustion DoS, one revision pin not propagated), four in SQLBot (file write to code execution, stored XSS, two SQL injections), and one in the Contentful MCP server (LLM-controlled host argument leaking the management token). All are incident_class tooling-cve with mapping_status draft. Severity is transcribed from the CNA's published CVSS base severity, and each record states that NVD carries it as a secondary metric and has not analysed it. INC-143 states that its CNA is VulnCheck, not the vendor, and that its sources disagree on the affected range. Eight records carry a drafted control failure against an OWASP ASVS control, each with a verbatim basis from the vendor advisory and an empty confirmed_by. INC-137 is left free for a parallel PR. Regenerated with generate.js and npm run stats. Co-Authored-By: Claude Opus 5.5 --- README.md | 2 +- data/entries/ASI02.json | 6 + data/entries/DSGAI01.json | 6 + data/entries/DSGAI02.json | 6 + data/entries/DSGAI04.json | 6 + data/entries/DSGAI12.json | 34 +- data/entries/LLM01.json | 6 + data/entries/LLM04.json | 24 ++ data/entries/LLM06.json | 12 + data/incidents.json | 880 +++++++++++++++++++++++++++++++++++++ data/stats.json | 12 +- docs/data.js | 100 ++++- docs/incidents.js | 882 +++++++++++++++++++++++++++++++++++++- 13 files changed, 1966 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index 49271bc..e8d436c 100644 --- a/README.md +++ b/README.md @@ -82,7 +82,7 @@ Every file answers one question: **which controls from framework X address vulne | **70+** open-source tools | Catalogued and organised by function | | **25** eval profiles | Runnable Garak (13) + PyRIT (6) + LAAF (6) tests mapped to OWASP entries | | **26** compliance reports | Per-framework gap assessments auto-generated from data layer (MD, CSV, JSON, OSCAL) | -| **136** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) | +| **147** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) | | **LAAF v2.0** | First agentic LPCI red-teaming framework — fully integrated with 6-stage × OWASP crosswalk | All free. All open-source. Built for practitioners. diff --git a/data/entries/ASI02.json b/data/entries/ASI02.json index 4ddabce..98cb0b9 100644 --- a/data/entries/ASI02.json +++ b/data/entries/ASI02.json @@ -1279,6 +1279,12 @@ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, "incident_id": "INC-136" + }, + { + "name": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-148" } ], "crossrefs": { diff --git a/data/entries/DSGAI01.json b/data/entries/DSGAI01.json index 91cde83..c82927d 100644 --- a/data/entries/DSGAI01.json +++ b/data/entries/DSGAI01.json @@ -1190,6 +1190,12 @@ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, "incident_id": "INC-135" + }, + { + "name": "SQLBot: SQL injection in table preview read server files through the internal PostgreSQL superuser", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-146" } ], "crossrefs": { diff --git a/data/entries/DSGAI02.json b/data/entries/DSGAI02.json index 48646a9..c2cc6e1 100644 --- a/data/entries/DSGAI02.json +++ b/data/entries/DSGAI02.json @@ -1053,6 +1053,12 @@ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, "incident_id": "INC-134" + }, + { + "name": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-148" } ], "crossrefs": { diff --git a/data/entries/DSGAI04.json b/data/entries/DSGAI04.json index f6fdc8d..2f8015c 100644 --- a/data/entries/DSGAI04.json +++ b/data/entries/DSGAI04.json @@ -1088,6 +1088,12 @@ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2025, "incident_id": "INC-108" + }, + { + "name": "LMDeploy: model config value passed to eval(), so loading a malicious Hugging Face model ran code", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-140" } ], "crossrefs": { diff --git a/data/entries/DSGAI12.json b/data/entries/DSGAI12.json index 1c69ac2..9f99a2c 100644 --- a/data/entries/DSGAI12.json +++ b/data/entries/DSGAI12.json @@ -323,7 +323,15 @@ "parent": "V5", "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", - "reviewed_by": [] + "reviewed_by": [], + "evidence_count": 0, + "evidence": { + "confirmed": [], + "drafted": [ + "INC-146", + "INC-147" + ] + } }, { "framework": "OWASP ASVS 4.0.3", @@ -982,6 +990,30 @@ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2023, "incident_id": "INC-078" + }, + { + "name": "SQLBot: spreadsheet upload wrote attacker-named files into the migration directory, run at next startup", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-144" + }, + { + "name": "SQLBot: SVG logo upload stored and served unsanitised, giving stored XSS in the application origin", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-145" + }, + { + "name": "SQLBot: SQL injection in table preview read server files through the internal PostgreSQL superuser", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-146" + }, + { + "name": "SQLBot: second-order SQL injection in datasource cleanup ran OS commands via COPY TO PROGRAM", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-147" } ], "crossrefs": { diff --git a/data/entries/LLM01.json b/data/entries/LLM01.json index a4822f7..8385e79 100644 --- a/data/entries/LLM01.json +++ b/data/entries/LLM01.json @@ -1438,6 +1438,12 @@ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, "incident_id": "INC-133" + }, + { + "name": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-148" } ], "crossrefs": { diff --git a/data/entries/LLM04.json b/data/entries/LLM04.json index 3508219..6a21666 100644 --- a/data/entries/LLM04.json +++ b/data/entries/LLM04.json @@ -1163,6 +1163,30 @@ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2023, "incident_id": "INC-079" + }, + { + "name": "LMDeploy: ZeroMQ RPC server deserialised network messages with pickle, giving remote code execution", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-138" + }, + { + "name": "LMDeploy: DistServe control plane deserialised pickle from a peer address any caller could set", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-139" + }, + { + "name": "LMDeploy: model config value passed to eval(), so loading a malicious Hugging Face model ran code", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-140" + }, + { + "name": "vLLM: operator's model revision pin not applied to some processor, tokenizer and config loads", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-143" } ], "crossrefs": { diff --git a/data/entries/LLM06.json b/data/entries/LLM06.json index e46d797..b969e7b 100644 --- a/data/entries/LLM06.json +++ b/data/entries/LLM06.json @@ -1038,6 +1038,18 @@ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, "incident_id": "INC-134" + }, + { + "name": "vLLM: chat audio path skipped the decode-duration guard, so a small upload could exhaust worker memory", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-141" + }, + { + "name": "vLLM: request-selected GPU video decoder bypassed the engine's static GPU memory reservation", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-142" } ], "crossrefs": { diff --git a/data/incidents.json b/data/incidents.json index d061ee1..42629c5 100644 --- a/data/incidents.json +++ b/data/incidents.json @@ -8571,6 +8571,886 @@ "confirmed_by": [] } ] + }, + { + "id": "INC-138", + "title": "LMDeploy: ZeroMQ RPC server deserialised network messages with pickle, giving remote code execution", + "date": "2026-09", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Critical", + "description": "GHSA-5h8j-6crg-7rmw / CVE-2025-59953, published by the LMDeploy maintainers on 2026-09-16, reports that the AsyncRPCServer in zmq_rpc.py, introduced in 0.9.1, deserialises received messages with pickle.loads() in call_and_response(). The maintainer assessment states that before 0.10.2 \"`AsyncRPCServer` bound to `tcp://*`, allowing a network peer that could reach the randomly selected RPC port to submit a malicious pickle payload\", and that 0.10.2 \"changed the RPC server binding to localhost, removing the remote network attack surface. The RPC protocol still uses pickle internally, so the loopback RPC endpoint must remain inaccessible to untrusted local processes.\" The fix release, 0.10.2, shipped on 2025-10-28, almost a year before the advisory was published. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 3.1 score of 9.8 (Critical) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own.", + "owasp_entries": [ + "LLM04" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "origin", + "notes": "The inference server's internal RPC transport was bound to all interfaces and deserialised with pickle" + } + ], + "attack_vector": "Network peer sends a crafted pickle payload to the inference server's ZeroMQ RPC port, which deserialises it with pickle.loads()", + "affected": "LMDeploy 0.9.1 up to but not including 0.10.2", + "impact": "Arbitrary code execution on the host running the LMDeploy server", + "mitigations": [ + "Upgrade to LMDeploy 0.10.2 or later", + "Keep the loopback RPC endpoint unreachable by untrusted local processes — the protocol still uses pickle internally", + "Use a data-only serialisation format for inter-process messages instead of pickle" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2025-59953", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59953" + }, + { + "source": "GHSA", + "id": "GHSA-5h8j-6crg-7rmw", + "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-5h8j-6crg-7rmw" + } + ], + "references": [ + { + "title": "NVD — CVE-2025-59953", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59953", + "type": "advisory" + }, + { + "title": "LMDeploy security advisory GHSA-5h8j-6crg-7rmw", + "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-5h8j-6crg-7rmw", + "type": "advisory" + }, + { + "title": "LMDeploy 0.10.2 release", + "url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.10.2", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "deserialization", + "rce", + "inference", + "lmdeploy", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.5", + "outcome": "absent", + "basis": "This advisory tracks remotely reachable arbitrary code execution caused by deserializing untrusted ZMQ RPC messages with `pickle.loads()`.", + "source_url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-5h8j-6crg-7rmw", + "confirmed_by": [] + } + ] + }, + { + "id": "INC-139", + "title": "LMDeploy: DistServe control plane deserialised pickle from a peer address any caller could set", + "date": "2026-09", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Critical", + "description": "GHSA-2vh9-42vm-xmv2 / CVE-2025-66455, published by the LMDeploy maintainers on 2026-09-16 and fixed in 0.16.0, reports that the PyTorch DistServe/PD-disaggregation control plane \"used `recv_pyobj()` to deserialize messages received through a ZeroMQ PULL socket\", which PyZMQ implements with pickle. The peer address came from the POST /distserve/p2p_connect HTTP endpoint, so \"an attacker who could reach an affected DistServe API server could cause the server to connect to an attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle payload.\" The advisory adds that \"API-key authentication is not enabled unless the operator explicitly configures it\", so DistServe deployments without API keys were exposed to unauthenticated remote code execution; deployments that do not use the disaggregated-serving path are not affected. The fix replaced pickle with JSON and validates received messages against a Pydantic schema. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 3.1 score of 9.8 (Critical) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Awaiting Analysis with no score of its own.", + "owasp_entries": [ + "LLM04" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "origin", + "notes": "Disaggregated-serving control plane connects to a caller-supplied ZeroMQ peer and unpickles what it receives" + } + ], + "attack_vector": "Caller submits an attacker-controlled ZeroMQ address to POST /distserve/p2p_connect; the inference engine connects to it and deserialises the crafted pickle payload with recv_pyobj()", + "affected": "LMDeploy 0.9.2 up to but not including 0.16.0, PyTorch backend with DistServe/PD-disaggregation enabled", + "impact": "Arbitrary code execution as the LMDeploy serving process; the advisory lists model weights, prompts, credentials, attached storage and cluster-network services as exposed", + "mitigations": [ + "Upgrade to LMDeploy 0.16.0 or later", + "Restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks and configure API-key authentication — the advisory notes these reduce exposure but do not make pickle safe", + "Use a data-only serialisation format with schema validation for control-plane messages" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2025-66455", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66455" + }, + { + "source": "GHSA", + "id": "GHSA-2vh9-42vm-xmv2", + "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-2vh9-42vm-xmv2" + } + ], + "references": [ + { + "title": "NVD — CVE-2025-66455", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66455", + "type": "advisory" + }, + { + "title": "LMDeploy security advisory GHSA-2vh9-42vm-xmv2", + "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-2vh9-42vm-xmv2", + "type": "advisory" + }, + { + "title": "LMDeploy 0.16.0 release", + "url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.16.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "deserialization", + "rce", + "inference", + "lmdeploy", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.5", + "outcome": "absent", + "basis": "LMDeploy's PyTorch DistServe/PD-disaggregation control plane used `recv_pyobj()` to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements `recv_pyobj()` using Python pickle deserialization, which can execute arbitrary code while reconstructing an object.", + "source_url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-2vh9-42vm-xmv2", + "confirmed_by": [] + } + ] + }, + { + "id": "INC-140", + "title": "LMDeploy: model config value passed to eval(), so loading a malicious Hugging Face model ran code", + "date": "2026-09", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "High", + "description": "GHSA-3hmm-rh5q-gwwr / CVE-2026-33625, published by the LMDeploy maintainers on 2026-09-16 and fixed in 0.12.3, reports a code injection in lmdeploy/pytorch/config.py: \"When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation.\" The value comes from quantization_config in the model's Hugging Face config, and an AWQ config does not override it, so a published model carrying a crafted quant_dtype executes arbitrary Python on any machine that loads it. The advisory notes that a neighbouring whitelist check covers torch_dtype but not quant_dtype. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 3.1 score of 8.8 (High) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The advisory classifies the weakness as CWE-95; the NVD record lists CWE-400.", + "owasp_entries": [ + "LLM04", + "DSGAI04" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L1", + "label": "Foundation Models", + "role": "origin", + "notes": "Malicious value carried in a published model configuration" + }, + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "impact", + "notes": "Code runs on the serving host when the model is loaded" + } + ], + "attack_vector": "Attacker publishes a model whose quantization_config.quant_dtype carries Python code; LMDeploy evaluates it with eval() when the model is loaded", + "affected": "LMDeploy 0.12.1 and 0.12.2", + "impact": "Arbitrary code execution on any host that loads the malicious model with LMDeploy", + "mitigations": [ + "Upgrade to LMDeploy 0.12.3 or later", + "Resolve configuration values against an allow-list rather than evaluating them as code", + "Load third-party models only from vetted sources, and treat model configuration as untrusted input" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-33625", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33625" + }, + { + "source": "GHSA", + "id": "GHSA-3hmm-rh5q-gwwr", + "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-3hmm-rh5q-gwwr" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-33625", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33625", + "type": "advisory" + }, + { + "title": "LMDeploy security advisory GHSA-3hmm-rh5q-gwwr", + "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-3hmm-rh5q-gwwr", + "type": "advisory" + }, + { + "title": "LMDeploy 0.12.3 release", + "url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "code-injection", + "model-supply-chain", + "lmdeploy", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.3.2", + "outcome": "absent", + "basis": "When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation.", + "source_url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-3hmm-rh5q-gwwr", + "confirmed_by": [] + } + ] + }, + { + "id": "INC-141", + "title": "vLLM: chat audio path skipped the decode-duration guard, so a small upload could exhaust worker memory", + "date": "2026-08", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Medium", + "description": "GHSA-hcwq-8wjf-3gcr / CVE-2026-57173, published by the vLLM maintainers on 2026-08-23 and fixed in 0.24.0, reports that \"the input_audio handling path for /v1/chat/completions calls AudioMediaIO.load_bytes or AudioMediaIO.load_file without passing VLLM_MAX_AUDIO_DECODE_DURATION_S to the shared audio decoder.\" The duration guard was applied only to /v1/audio/transcriptions, so a few kilobytes of compressed audio sent to the chat endpoint can expand into a multi-gigabyte float32 PCM allocation and crash the worker; inline data URLs are not bounded by VLLM_AUDIO_FETCH_TIMEOUT either. It affects deployments serving an audio-capable model. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 3.1 score of 6.5 (Medium) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Undergoing Analysis with no score of its own. The vector scores privileges required as Low, although the advisory describes the endpoint as having no authentication unless an API key is configured.", + "owasp_entries": [ + "LLM06" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "origin", + "notes": "Multimodal input decoding in the inference server applied a resource limit on one endpoint only" + } + ], + "attack_vector": "Client sends a small compressed audio clip as input_audio to /v1/chat/completions; it is decoded without the duration limit and expands into a very large PCM buffer", + "affected": "vLLM before 0.24.0, deployments serving an audio-capable model", + "impact": "Out-of-memory crash of the inference worker — denial of service", + "mitigations": [ + "Upgrade to vLLM 0.24.0 or later", + "Apply decode-size and duration limits on every media input path, not per endpoint", + "Require API-key authentication on the serving endpoint" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-57173", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57173" + }, + { + "source": "GHSA", + "id": "GHSA-hcwq-8wjf-3gcr", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-hcwq-8wjf-3gcr" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-57173", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57173", + "type": "advisory" + }, + { + "title": "vLLM security advisory GHSA-hcwq-8wjf-3gcr", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-hcwq-8wjf-3gcr", + "type": "advisory" + }, + { + "title": "vLLM 0.24.0 release", + "url": "https://github.com/vllm-project/vllm/releases/tag/v0.24.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "denial-of-service", + "multimodal", + "inference", + "vllm", + "draft-mapping" + ] + }, + { + "id": "INC-142", + "title": "vLLM: request-selected GPU video decoder bypassed the engine's static GPU memory reservation", + "date": "2026-08", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Medium", + "description": "GHSA-8pw2-6jv3-mj5j / CVE-2026-69147, published by the vLLM maintainers on 2026-08-28 and fixed in 0.28.0, reports that request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_backend to pynvvideocodec, and that MediaConnector.fetch_video forwards that choice even when the server was started with a software decoder. The engine reserves decoder GPU memory from static configuration only, so the CUDA context, decoder surfaces and decoded frames of the request-selected decoder are not deducted from the engine's KV-cache budget. A client able to submit video requests to a video-capable GPU deployment with PyNvVideoCodec installed can exhaust shared GPU memory, causing request failures, worker crashes or denial of service. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 3.1 score of 6.5 (Medium) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Awaiting Analysis with no score of its own.", + "owasp_entries": [ + "LLM06" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "origin", + "notes": "Per-request media options select a GPU decoder whose memory the engine never budgeted" + } + ], + "attack_vector": "Client sets media_io_kwargs.video.video_backend to pynvvideocodec in an inference request, selecting a GPU decoder outside the startup memory reservation", + "affected": "vLLM before 0.28.0, video-capable GPU deployments with PyNvVideoCodec installed", + "impact": "Exhaustion of GPU memory shared with the inference engine — request failures, worker crashes, denial of service", + "mitigations": [ + "Upgrade to vLLM 0.28.0 or later", + "Do not let request parameters select backends or resources outside the startup configuration", + "Budget GPU memory for every decoder backend that is installed, not only the configured default" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-69147", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69147" + }, + { + "source": "GHSA", + "id": "GHSA-8pw2-6jv3-mj5j", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-69147", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69147", + "type": "advisory" + }, + { + "title": "vLLM security advisory GHSA-8pw2-6jv3-mj5j", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j", + "type": "advisory" + }, + { + "title": "vLLM 0.28.0 release", + "url": "https://github.com/vllm-project/vllm/releases/tag/v0.28.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "denial-of-service", + "multimodal", + "gpu", + "inference", + "vllm", + "draft-mapping" + ] + }, + { + "id": "INC-143", + "title": "vLLM: operator's model revision pin not applied to some processor, tokenizer and config loads", + "date": "2026-09", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Medium", + "description": "CVE-2026-100653 and the vLLM advisory GHSA-hhv2-872h-628q (published 2026-09-12) report that for the FunAudioChat and Tarsier2 architectures the operator-supplied --revision / --code-revision pin was not passed to the WhisperFeatureExtractor and speech_tokenizer loads in funaudiochat.py, or to the Qwen2VLConfig.from_pretrained call used by Tarsier2. Deployments pinned to a reviewed revision therefore still resolved these artifacts from the repository's default revision, so a later upstream change could alter audio preprocessing, speech tokenisation or Tarsier2 configuration without any change to the pin. The advisory calls this \"a supply-chain integrity and reproducibility failure for pinned deployments\" and states that \"It does not claim unauthenticated RCE or a `trust_remote_code=False` bypass.\"; it is residual to the earlier fix for GHSA-3ww4-5jv9-j5gm / CVE-2026-47155. Provenance, stated plainly: the CNA is VulnCheck, not the vendor. VulnCheck publishes a CVSS 3.1 score of 6.5 (Medium), the same score the vendor advisory carries, and a CVSS 4.0 score of 8.3 (High); this record transcribes the CVSS 3.1 severity because it is the one the vendor advisory and the CNA agree on. NVD lists both as secondary metrics and the record as Awaiting Analysis. The sources are inconsistent on the upper bound: the CVE text says \"from 0.22.1 through 0.28.0\" yet names 0.28.0 as the fix, and the advisory lists >= 0.22.1, <= 0.28.0 as affected with 0.28.0 as patched; it also says the lower bound may be as early as 0.21.0. The commit NVD lists as a reference is the earlier CVE-2026-47155 fix, not this one.", + "owasp_entries": [ + "LLM04" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L1", + "label": "Foundation Models", + "role": "origin", + "notes": "Processor, tokenizer and config artifacts resolved from the upstream repository's default branch" + }, + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "propagation", + "notes": "The serving engine's artifact loads drop the operator's revision pin" + } + ], + "attack_vector": "A change to the default branch of an upstream model repository is picked up by artifact loads that ignore the operator's revision pin", + "affected": "vLLM from 0.22.1, fixed in 0.28.0 (see the description on the stated range), FunAudioChat and Tarsier2 architectures", + "impact": "Pinned deployments load unreviewed processor, tokenizer or config artifacts, so model behaviour can change without any change to the pin", + "mitigations": [ + "Upgrade to vLLM 0.28.0 or later", + "Propagate the revision pin to every artifact a model loads, including processors, tokenizers and sub-configs", + "Serve production models from an internal mirror whose contents are integrity-verified" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-100653", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100653" + }, + { + "source": "GHSA", + "id": "GHSA-hhv2-872h-628q", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-100653", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100653", + "type": "advisory" + }, + { + "title": "vLLM security advisory GHSA-hhv2-872h-628q", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q", + "type": "advisory" + }, + { + "title": "VulnCheck advisory — vLLM incomplete artifact pin propagation (CNA record)", + "url": "https://www.vulncheck.com/advisories/vllm-0.22.1-before-0.28.0-incomplete-artifact-pin-propagation", + "type": "advisory" + }, + { + "title": "vLLM 0.28.0 release", + "url": "https://github.com/vllm-project/vllm/releases/tag/v0.28.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "model-supply-chain", + "artifact-pinning", + "vllm", + "draft-mapping" + ] + }, + { + "id": "INC-144", + "title": "SQLBot: spreadsheet upload wrote attacker-named files into the migration directory, run at next startup", + "date": "2026-06", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "High", + "description": "GHSA-wxv4-pw5w-wx79 / CVE-2026-53554, published by the SQLBot maintainers on 2026-06-09 with the 1.9.0 fix release, reports that the POST /api/v1/datasource/parseExcel endpoint of SQLBot — a text-to-SQL system built on LLMs and RAG — uses the client-supplied multipart filename when choosing where to store an upload, writes the content before spreadsheet parsing and validation finish, and can turn a double-extension filename into a Python source file. The advisory states that \"the upload handler trusts attacker-supplied filename information and allows it to influence the final storage location\", and that \"a failed upload request still produces a successful arbitrary file write.\" A module planted in /opt/sqlbot/app/alembic/versions/ is imported by Alembic, and its module-level code run, at the next startup or migration. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 4.0 score of 7.3 (High) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The repository advisory labels the issue High without a vector; this record transcribes the CNA's CVSS base severity.", + "owasp_entries": [ + "DSGAI12" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "origin", + "notes": "Datasource upload handler in the text-to-SQL application stores files under a client-chosen path" + } + ], + "attack_vector": "Crafted multipart filename on the spreadsheet-upload endpoint places a Python module in the Alembic migration directory", + "affected": "SQLBot before 1.9.0", + "impact": "Code execution in the SQLBot application runtime at the next startup or migration", + "mitigations": [ + "Upgrade to SQLBot 1.9.0 or later", + "Store uploads under server-generated names in a dedicated directory outside application code paths", + "Validate uploaded content before writing it to disk" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-53554", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53554" + }, + { + "source": "GHSA", + "id": "GHSA-wxv4-pw5w-wx79", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-wxv4-pw5w-wx79" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-53554", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53554", + "type": "advisory" + }, + { + "title": "SQLBot security advisory GHSA-wxv4-pw5w-wx79", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-wxv4-pw5w-wx79", + "type": "advisory" + }, + { + "title": "SQLBot 1.9.0 release", + "url": "https://github.com/dataease/SQLBot/releases/tag/v1.9.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "file-upload", + "code-execution", + "text-to-sql", + "sqlbot", + "draft-mapping" + ] + }, + { + "id": "INC-145", + "title": "SQLBot: SVG logo upload stored and served unsanitised, giving stored XSS in the application origin", + "date": "2026-06", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Medium", + "description": "GHSA-v23m-5pvq-xcgx / CVE-2026-53555, published by the SQLBot maintainers on 2026-06-09 with the 1.9.0 fix release, reports that an authenticated uploader can set an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and that \"The application accepts image/svg+xml uploads and stores uploaded SVG files without sanitization or validation.\" The file is served inline from the same origin through GET /api/v1/system/assistant/picture/{filename}, so script embedded in the SVG runs in the SQLBot web application when another user loads it, with access to the data and actions available to that user's session. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 4.0 score of 5.1 (Medium) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The repository advisory labels the issue High without a vector; this record transcribes the CNA's CVSS base severity.", + "owasp_entries": [ + "DSGAI12" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "origin", + "notes": "Assistant UI asset upload stored and served from the application origin without sanitisation" + } + ], + "attack_vector": "Authenticated user uploads an SVG containing script as the assistant UI logo; it executes in the browser of any user who loads it", + "affected": "SQLBot before 1.9.0", + "impact": "Script execution in other users' SQLBot sessions, with access to the data and actions available to them", + "mitigations": [ + "Upgrade to SQLBot 1.9.0 or later", + "Sanitise SVG uploads or convert them to raster images before storing", + "Serve user-uploaded files from a separate origin or with Content-Disposition: attachment and a restrictive CSP" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-53555", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53555" + }, + { + "source": "GHSA", + "id": "GHSA-v23m-5pvq-xcgx", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-53555", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53555", + "type": "advisory" + }, + { + "title": "SQLBot security advisory GHSA-v23m-5pvq-xcgx", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx", + "type": "advisory" + }, + { + "title": "SQLBot 1.9.0 release", + "url": "https://github.com/dataease/SQLBot/releases/tag/v1.9.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "xss", + "file-upload", + "text-to-sql", + "sqlbot", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.3.5", + "outcome": "absent", + "basis": "The application accepts image/svg+xml uploads and stores uploaded SVG files without sanitization or validation.", + "source_url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx", + "confirmed_by": [] + } + ] + }, + { + "id": "INC-146", + "title": "SQLBot: SQL injection in table preview read server files through the internal PostgreSQL superuser", + "date": "2026-06", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Medium", + "description": "GHSA-vwjq-5h4h-x8g5 / CVE-2026-53556, published by the SQLBot maintainers on 2026-06-09 with the 1.9.0 fix release, reports a chain of three weaknesses behind POST /api/v1/datasource/previewData. The client-supplied table_name \"is incorporated into the generated SQL query without sufficient validation or safe identifier handling\"; the read-only policy blocks specific write operations but still permits a SELECT that calls pg_read_file(), pg_read_binary_file() or pg_ls_dir(); and the bundled PostgreSQL trusts loopback connections, which in testing \"successfully authenticated as the PostgreSQL root superuser even when an intentionally incorrect password was supplied\". An authenticated user who points a datasource at the internal instance can therefore read server files such as /etc/passwd through the API response, potentially exposing configuration, credentials and source code. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 4.0 score of 6.0 (Medium) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The repository advisory labels the issue High without a vector; this record transcribes the CNA's CVSS base severity.", + "owasp_entries": [ + "DSGAI12", + "DSGAI01" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L2", + "label": "Data Operations", + "role": "origin", + "notes": "Datasource preview in the text-to-SQL application builds SQL from a client-supplied identifier" + }, + { + "layer": "L6", + "label": "Security & Compliance", + "role": "propagation", + "notes": "Read-only filtering and loopback trust let the injected query run as database superuser" + } + ], + "attack_vector": "Crafted table_name in a previewData request against a datasource pointing at the internal PostgreSQL instance, invoking pg_read_file() inside a permitted SELECT", + "affected": "SQLBot before 1.9.0", + "impact": "Arbitrary file read from the application server, potentially exposing configuration, credentials, secrets and source code", + "mitigations": [ + "Upgrade to SQLBot 1.9.0 or later", + "Quote identifiers with the driver's identifier-escaping API or resolve them against the catalogue, never by string building", + "Connect to datasources with least-privilege roles and require password authentication on loopback" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-53556", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53556" + }, + { + "source": "GHSA", + "id": "GHSA-vwjq-5h4h-x8g5", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vwjq-5h4h-x8g5" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-53556", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53556", + "type": "advisory" + }, + { + "title": "SQLBot security advisory GHSA-vwjq-5h4h-x8g5", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vwjq-5h4h-x8g5", + "type": "advisory" + }, + { + "title": "SQLBot 1.9.0 release", + "url": "https://github.com/dataease/SQLBot/releases/tag/v1.9.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "sql-injection", + "file-disclosure", + "text-to-sql", + "sqlbot", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.2.4", + "outcome": "absent", + "basis": "The supplied `table_name` is incorporated into the generated SQL query without sufficient validation or safe identifier handling, allowing attacker-controlled SQL fragments to become part of the executed query.", + "source_url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vwjq-5h4h-x8g5", + "confirmed_by": [] + } + ] + }, + { + "id": "INC-147", + "title": "SQLBot: second-order SQL injection in datasource cleanup ran OS commands via COPY TO PROGRAM", + "date": "2026-06", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "High", + "description": "GHSA-vxwj-843f-9c9g / CVE-2026-53557, published by the SQLBot maintainers on 2026-06-09 with the 1.9.0 fix release, reports that an authenticated user can store a crafted sheet[\"tableName\"] value in an Excel datasource configuration submitted to POST /api/v1/datasource/. When the datasource is later deleted through DELETE /api/v1/datasource/{id}, \"this stored data is directly interpolated into SQL queries without parameterized query usage or proper escaping\", and the injected statement can use PostgreSQL's COPY TO PROGRAM to run operating-system commands with the privileges of the postgres process inside the SQLBot container. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 4.0 score of 7.7 (High) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The repository advisory labels the issue High without a vector; this record transcribes the CNA's CVSS base severity.", + "owasp_entries": [ + "DSGAI12" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L2", + "label": "Data Operations", + "role": "origin", + "notes": "Stored datasource configuration in the text-to-SQL application is interpolated into cleanup SQL" + }, + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "impact", + "notes": "Commands run inside the application container as the database process" + } + ], + "attack_vector": "Crafted sheet[\"tableName\"] stored with an Excel datasource and interpolated into SQL when the datasource is deleted, invoking COPY TO PROGRAM", + "affected": "SQLBot before 1.9.0", + "impact": "Operating-system command execution inside the SQLBot container with the privileges of the postgres process", + "mitigations": [ + "Upgrade to SQLBot 1.9.0 or later", + "Treat stored configuration as untrusted when it is reused in SQL — escape identifiers at use, not only at input", + "Run the application database role without superuser or pg_execute_server_program rights" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-53557", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53557" + }, + { + "source": "GHSA", + "id": "GHSA-vxwj-843f-9c9g", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vxwj-843f-9c9g" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-53557", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53557", + "type": "advisory" + }, + { + "title": "SQLBot security advisory GHSA-vxwj-843f-9c9g", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vxwj-843f-9c9g", + "type": "advisory" + }, + { + "title": "SQLBot 1.9.0 release", + "url": "https://github.com/dataease/SQLBot/releases/tag/v1.9.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "sql-injection", + "code-execution", + "text-to-sql", + "sqlbot", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.2.4", + "outcome": "absent", + "basis": "When the datasource is later deleted, this stored data is directly interpolated into SQL queries without parameterized query usage or proper escaping.", + "source_url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vxwj-843f-9c9g", + "confirmed_by": [] + } + ] + }, + { + "id": "INC-148", + "title": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", + "date": "2026-06", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "High", + "description": "GHSA-2xhg-73j7-rrgx / CVE-2026-53957, published by the Contentful MCP server maintainers on 2026-06-12, reports that the export_space and import_space tools in @contentful/mcp-tools \"accept LLM-controlled `host` and `proxy` parameters that are spread directly into the options object passed to `contentful-export` / `contentful-import`\", which combine them with the server's Contentful Management API personal access token. Once space_to_space_migration_handler has enabled the migration tools, a direct MCP call — or prompt injection through Contentful content the model reads — can send Management API requests, with their Authorization header, to an attacker-controlled host or proxy. The advisory notes that the other tools are unaffected because createToolClient pins the host from server configuration. A leaked token gives persistent out-of-band access to every Contentful space within its scope. The fix shipped in @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5 on 2026-06-01. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 3.1 score of 7.7 (High) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The GitHub-reviewed advisory database entry agrees with the CVE on the fixed versions; the repository advisory itself lists the versions it tested (<= 1.7.15 / <= 0.4.1) with no patched version.", + "owasp_entries": [ + "LLM01", + "ASI02", + "DSGAI02" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L3", + "label": "Agent Frameworks", + "role": "origin", + "notes": "MCP tools expose network endpoint options to model-controlled arguments" + }, + { + "layer": "L6", + "label": "Security & Compliance", + "role": "impact", + "notes": "The server's management credential is attached to requests sent to the attacker's host" + } + ], + "attack_vector": "Direct MCP tool call, or prompt injection in Contentful content, sets the host or proxy argument of export_space or import_space, redirecting authenticated Management API requests", + "affected": "@contentful/mcp-server before 1.7.19 and @contentful/mcp-tools before 0.4.5", + "impact": "Exposure of the Contentful management token, giving persistent out-of-band access to every space within its scope", + "mitigations": [ + "Upgrade to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5 or later", + "Take network endpoints from server configuration, never from tool arguments the model can set", + "Scope MCP server credentials to the spaces the deployment needs, and rotate any token that may have been exposed" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-53957", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53957" + }, + { + "source": "GHSA", + "id": "GHSA-2xhg-73j7-rrgx", + "url": "https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-53957", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53957", + "type": "advisory" + }, + { + "title": "Contentful MCP server security advisory GHSA-2xhg-73j7-rrgx", + "url": "https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx", + "type": "advisory" + }, + { + "title": "@contentful/mcp-server 1.7.19 release", + "url": "https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-server@1.7.19", + "type": "vendor" + }, + { + "title": "@contentful/mcp-tools 0.4.5 release", + "url": "https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-tools@0.4.5", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "mcp", + "prompt-injection", + "credential-exposure", + "ssrf", + "contentful", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.3.6", + "outcome": "absent", + "basis": "`export_space` and `import_space` tools in `@contentful/mcp-tools` accept LLM-controlled `host` and `proxy` parameters that are spread directly into the options object passed to `contentful-export` / `contentful-import`.", + "source_url": "https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx", + "confirmed_by": [] + } + ] } ] } diff --git a/data/stats.json b/data/stats.json index 13d0644..e926b44 100644 --- a/data/stats.json +++ b/data/stats.json @@ -61,16 +61,16 @@ } }, "incidents": { - "total": 136 + "total": 147 }, "evidence": { - "incidents_annotated": 17, - "control_failures": 22, + "incidents_annotated": 24, + "control_failures": 29, "confirmed": 0, - "drafted": 22, + "drafted": 29, "mappings_with_confirmed_evidence": 0, - "mappings_with_drafted_evidence_only": 22, - "orphan_failures": 1 + "mappings_with_drafted_evidence_only": 23, + "orphan_failures": 6 }, "freshness": { "checked": 5, diff --git a/docs/data.js b/docs/data.js index 67a40e1..c5df835 100644 --- a/docs/data.js +++ b/docs/data.js @@ -1442,6 +1442,12 @@ window.CROSSWALK_DATA = [ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, "incident_id": "INC-133" + }, + { + "name": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-148" } ], "crossrefs": { @@ -5101,6 +5107,30 @@ window.CROSSWALK_DATA = [ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2023, "incident_id": "INC-079" + }, + { + "name": "LMDeploy: ZeroMQ RPC server deserialised network messages with pickle, giving remote code execution", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-138" + }, + { + "name": "LMDeploy: DistServe control plane deserialised pickle from a peer address any caller could set", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-139" + }, + { + "name": "LMDeploy: model config value passed to eval(), so loading a malicious Hugging Face model ran code", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-140" + }, + { + "name": "vLLM: operator's model revision pin not applied to some processor, tokenizer and config loads", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-143" } ], "crossrefs": { @@ -7354,6 +7384,18 @@ window.CROSSWALK_DATA = [ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, "incident_id": "INC-134" + }, + { + "name": "vLLM: chat audio path skipped the decode-duration guard, so a small upload could exhaust worker memory", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-141" + }, + { + "name": "vLLM: request-selected GPU video decoder bypassed the engine's static GPU memory reservation", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-142" } ], "crossrefs": { @@ -15518,6 +15560,12 @@ window.CROSSWALK_DATA = [ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, "incident_id": "INC-136" + }, + { + "name": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-148" } ], "crossrefs": { @@ -26336,6 +26384,12 @@ window.CROSSWALK_DATA = [ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, "incident_id": "INC-135" + }, + { + "name": "SQLBot: SQL injection in table preview read server files through the internal PostgreSQL superuser", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-146" } ], "crossrefs": { @@ -27417,6 +27471,12 @@ window.CROSSWALK_DATA = [ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, "incident_id": "INC-134" + }, + { + "name": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-148" } ], "crossrefs": { @@ -29525,6 +29585,12 @@ window.CROSSWALK_DATA = [ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2025, "incident_id": "INC-108" + }, + { + "name": "LMDeploy: model config value passed to eval(), so loading a malicious Hugging Face model ran code", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-140" } ], "crossrefs": { @@ -36850,7 +36916,15 @@ window.CROSSWALK_DATA = [ "parent": "V5", "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", - "reviewed_by": [] + "reviewed_by": [], + "evidence_count": 0, + "evidence": { + "confirmed": [], + "drafted": [ + "INC-146", + "INC-147" + ] + } }, { "framework": "OWASP ASVS 4.0.3", @@ -37509,6 +37583,30 @@ window.CROSSWALK_DATA = [ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2023, "incident_id": "INC-078" + }, + { + "name": "SQLBot: spreadsheet upload wrote attacker-named files into the migration directory, run at next startup", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-144" + }, + { + "name": "SQLBot: SVG logo upload stored and served unsanitised, giving stored XSS in the application origin", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-145" + }, + { + "name": "SQLBot: SQL injection in table preview read server files through the internal PostgreSQL superuser", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-146" + }, + { + "name": "SQLBot: second-order SQL injection in datasource cleanup ran OS commands via COPY TO PROGRAM", + "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", + "year": 2026, + "incident_id": "INC-147" } ], "crossrefs": { diff --git a/docs/incidents.js b/docs/incidents.js index 93a7815..4261173 100644 --- a/docs/incidents.js +++ b/docs/incidents.js @@ -1,5 +1,5 @@ // Auto-generated by scripts/generate.js — do not edit manually -// Incidents: 136 +// Incidents: 147 window.CROSSWALK_INCIDENTS = [ { "id": "INC-001", @@ -8569,5 +8569,885 @@ window.CROSSWALK_INCIDENTS = [ "confirmed_by": [] } ] + }, + { + "id": "INC-138", + "title": "LMDeploy: ZeroMQ RPC server deserialised network messages with pickle, giving remote code execution", + "date": "2026-09", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Critical", + "description": "GHSA-5h8j-6crg-7rmw / CVE-2025-59953, published by the LMDeploy maintainers on 2026-09-16, reports that the AsyncRPCServer in zmq_rpc.py, introduced in 0.9.1, deserialises received messages with pickle.loads() in call_and_response(). The maintainer assessment states that before 0.10.2 \"`AsyncRPCServer` bound to `tcp://*`, allowing a network peer that could reach the randomly selected RPC port to submit a malicious pickle payload\", and that 0.10.2 \"changed the RPC server binding to localhost, removing the remote network attack surface. The RPC protocol still uses pickle internally, so the loopback RPC endpoint must remain inaccessible to untrusted local processes.\" The fix release, 0.10.2, shipped on 2025-10-28, almost a year before the advisory was published. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 3.1 score of 9.8 (Critical) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own.", + "owasp_entries": [ + "LLM04" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "origin", + "notes": "The inference server's internal RPC transport was bound to all interfaces and deserialised with pickle" + } + ], + "attack_vector": "Network peer sends a crafted pickle payload to the inference server's ZeroMQ RPC port, which deserialises it with pickle.loads()", + "affected": "LMDeploy 0.9.1 up to but not including 0.10.2", + "impact": "Arbitrary code execution on the host running the LMDeploy server", + "mitigations": [ + "Upgrade to LMDeploy 0.10.2 or later", + "Keep the loopback RPC endpoint unreachable by untrusted local processes — the protocol still uses pickle internally", + "Use a data-only serialisation format for inter-process messages instead of pickle" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2025-59953", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59953" + }, + { + "source": "GHSA", + "id": "GHSA-5h8j-6crg-7rmw", + "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-5h8j-6crg-7rmw" + } + ], + "references": [ + { + "title": "NVD — CVE-2025-59953", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59953", + "type": "advisory" + }, + { + "title": "LMDeploy security advisory GHSA-5h8j-6crg-7rmw", + "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-5h8j-6crg-7rmw", + "type": "advisory" + }, + { + "title": "LMDeploy 0.10.2 release", + "url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.10.2", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "deserialization", + "rce", + "inference", + "lmdeploy", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.5", + "outcome": "absent", + "basis": "This advisory tracks remotely reachable arbitrary code execution caused by deserializing untrusted ZMQ RPC messages with `pickle.loads()`.", + "source_url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-5h8j-6crg-7rmw", + "confirmed_by": [] + } + ] + }, + { + "id": "INC-139", + "title": "LMDeploy: DistServe control plane deserialised pickle from a peer address any caller could set", + "date": "2026-09", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Critical", + "description": "GHSA-2vh9-42vm-xmv2 / CVE-2025-66455, published by the LMDeploy maintainers on 2026-09-16 and fixed in 0.16.0, reports that the PyTorch DistServe/PD-disaggregation control plane \"used `recv_pyobj()` to deserialize messages received through a ZeroMQ PULL socket\", which PyZMQ implements with pickle. The peer address came from the POST /distserve/p2p_connect HTTP endpoint, so \"an attacker who could reach an affected DistServe API server could cause the server to connect to an attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle payload.\" The advisory adds that \"API-key authentication is not enabled unless the operator explicitly configures it\", so DistServe deployments without API keys were exposed to unauthenticated remote code execution; deployments that do not use the disaggregated-serving path are not affected. The fix replaced pickle with JSON and validates received messages against a Pydantic schema. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 3.1 score of 9.8 (Critical) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Awaiting Analysis with no score of its own.", + "owasp_entries": [ + "LLM04" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "origin", + "notes": "Disaggregated-serving control plane connects to a caller-supplied ZeroMQ peer and unpickles what it receives" + } + ], + "attack_vector": "Caller submits an attacker-controlled ZeroMQ address to POST /distserve/p2p_connect; the inference engine connects to it and deserialises the crafted pickle payload with recv_pyobj()", + "affected": "LMDeploy 0.9.2 up to but not including 0.16.0, PyTorch backend with DistServe/PD-disaggregation enabled", + "impact": "Arbitrary code execution as the LMDeploy serving process; the advisory lists model weights, prompts, credentials, attached storage and cluster-network services as exposed", + "mitigations": [ + "Upgrade to LMDeploy 0.16.0 or later", + "Restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks and configure API-key authentication — the advisory notes these reduce exposure but do not make pickle safe", + "Use a data-only serialisation format with schema validation for control-plane messages" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2025-66455", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66455" + }, + { + "source": "GHSA", + "id": "GHSA-2vh9-42vm-xmv2", + "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-2vh9-42vm-xmv2" + } + ], + "references": [ + { + "title": "NVD — CVE-2025-66455", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66455", + "type": "advisory" + }, + { + "title": "LMDeploy security advisory GHSA-2vh9-42vm-xmv2", + "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-2vh9-42vm-xmv2", + "type": "advisory" + }, + { + "title": "LMDeploy 0.16.0 release", + "url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.16.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "deserialization", + "rce", + "inference", + "lmdeploy", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.5", + "outcome": "absent", + "basis": "LMDeploy's PyTorch DistServe/PD-disaggregation control plane used `recv_pyobj()` to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements `recv_pyobj()` using Python pickle deserialization, which can execute arbitrary code while reconstructing an object.", + "source_url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-2vh9-42vm-xmv2", + "confirmed_by": [] + } + ] + }, + { + "id": "INC-140", + "title": "LMDeploy: model config value passed to eval(), so loading a malicious Hugging Face model ran code", + "date": "2026-09", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "High", + "description": "GHSA-3hmm-rh5q-gwwr / CVE-2026-33625, published by the LMDeploy maintainers on 2026-09-16 and fixed in 0.12.3, reports a code injection in lmdeploy/pytorch/config.py: \"When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation.\" The value comes from quantization_config in the model's Hugging Face config, and an AWQ config does not override it, so a published model carrying a crafted quant_dtype executes arbitrary Python on any machine that loads it. The advisory notes that a neighbouring whitelist check covers torch_dtype but not quant_dtype. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 3.1 score of 8.8 (High) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The advisory classifies the weakness as CWE-95; the NVD record lists CWE-400.", + "owasp_entries": [ + "LLM04", + "DSGAI04" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L1", + "label": "Foundation Models", + "role": "origin", + "notes": "Malicious value carried in a published model configuration" + }, + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "impact", + "notes": "Code runs on the serving host when the model is loaded" + } + ], + "attack_vector": "Attacker publishes a model whose quantization_config.quant_dtype carries Python code; LMDeploy evaluates it with eval() when the model is loaded", + "affected": "LMDeploy 0.12.1 and 0.12.2", + "impact": "Arbitrary code execution on any host that loads the malicious model with LMDeploy", + "mitigations": [ + "Upgrade to LMDeploy 0.12.3 or later", + "Resolve configuration values against an allow-list rather than evaluating them as code", + "Load third-party models only from vetted sources, and treat model configuration as untrusted input" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-33625", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33625" + }, + { + "source": "GHSA", + "id": "GHSA-3hmm-rh5q-gwwr", + "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-3hmm-rh5q-gwwr" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-33625", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33625", + "type": "advisory" + }, + { + "title": "LMDeploy security advisory GHSA-3hmm-rh5q-gwwr", + "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-3hmm-rh5q-gwwr", + "type": "advisory" + }, + { + "title": "LMDeploy 0.12.3 release", + "url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "code-injection", + "model-supply-chain", + "lmdeploy", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.3.2", + "outcome": "absent", + "basis": "When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation.", + "source_url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-3hmm-rh5q-gwwr", + "confirmed_by": [] + } + ] + }, + { + "id": "INC-141", + "title": "vLLM: chat audio path skipped the decode-duration guard, so a small upload could exhaust worker memory", + "date": "2026-08", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Medium", + "description": "GHSA-hcwq-8wjf-3gcr / CVE-2026-57173, published by the vLLM maintainers on 2026-08-23 and fixed in 0.24.0, reports that \"the input_audio handling path for /v1/chat/completions calls AudioMediaIO.load_bytes or AudioMediaIO.load_file without passing VLLM_MAX_AUDIO_DECODE_DURATION_S to the shared audio decoder.\" The duration guard was applied only to /v1/audio/transcriptions, so a few kilobytes of compressed audio sent to the chat endpoint can expand into a multi-gigabyte float32 PCM allocation and crash the worker; inline data URLs are not bounded by VLLM_AUDIO_FETCH_TIMEOUT either. It affects deployments serving an audio-capable model. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 3.1 score of 6.5 (Medium) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Undergoing Analysis with no score of its own. The vector scores privileges required as Low, although the advisory describes the endpoint as having no authentication unless an API key is configured.", + "owasp_entries": [ + "LLM06" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "origin", + "notes": "Multimodal input decoding in the inference server applied a resource limit on one endpoint only" + } + ], + "attack_vector": "Client sends a small compressed audio clip as input_audio to /v1/chat/completions; it is decoded without the duration limit and expands into a very large PCM buffer", + "affected": "vLLM before 0.24.0, deployments serving an audio-capable model", + "impact": "Out-of-memory crash of the inference worker — denial of service", + "mitigations": [ + "Upgrade to vLLM 0.24.0 or later", + "Apply decode-size and duration limits on every media input path, not per endpoint", + "Require API-key authentication on the serving endpoint" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-57173", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57173" + }, + { + "source": "GHSA", + "id": "GHSA-hcwq-8wjf-3gcr", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-hcwq-8wjf-3gcr" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-57173", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57173", + "type": "advisory" + }, + { + "title": "vLLM security advisory GHSA-hcwq-8wjf-3gcr", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-hcwq-8wjf-3gcr", + "type": "advisory" + }, + { + "title": "vLLM 0.24.0 release", + "url": "https://github.com/vllm-project/vllm/releases/tag/v0.24.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "denial-of-service", + "multimodal", + "inference", + "vllm", + "draft-mapping" + ] + }, + { + "id": "INC-142", + "title": "vLLM: request-selected GPU video decoder bypassed the engine's static GPU memory reservation", + "date": "2026-08", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Medium", + "description": "GHSA-8pw2-6jv3-mj5j / CVE-2026-69147, published by the vLLM maintainers on 2026-08-28 and fixed in 0.28.0, reports that request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_backend to pynvvideocodec, and that MediaConnector.fetch_video forwards that choice even when the server was started with a software decoder. The engine reserves decoder GPU memory from static configuration only, so the CUDA context, decoder surfaces and decoded frames of the request-selected decoder are not deducted from the engine's KV-cache budget. A client able to submit video requests to a video-capable GPU deployment with PyNvVideoCodec installed can exhaust shared GPU memory, causing request failures, worker crashes or denial of service. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 3.1 score of 6.5 (Medium) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Awaiting Analysis with no score of its own.", + "owasp_entries": [ + "LLM06" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "origin", + "notes": "Per-request media options select a GPU decoder whose memory the engine never budgeted" + } + ], + "attack_vector": "Client sets media_io_kwargs.video.video_backend to pynvvideocodec in an inference request, selecting a GPU decoder outside the startup memory reservation", + "affected": "vLLM before 0.28.0, video-capable GPU deployments with PyNvVideoCodec installed", + "impact": "Exhaustion of GPU memory shared with the inference engine — request failures, worker crashes, denial of service", + "mitigations": [ + "Upgrade to vLLM 0.28.0 or later", + "Do not let request parameters select backends or resources outside the startup configuration", + "Budget GPU memory for every decoder backend that is installed, not only the configured default" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-69147", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69147" + }, + { + "source": "GHSA", + "id": "GHSA-8pw2-6jv3-mj5j", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-69147", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69147", + "type": "advisory" + }, + { + "title": "vLLM security advisory GHSA-8pw2-6jv3-mj5j", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j", + "type": "advisory" + }, + { + "title": "vLLM 0.28.0 release", + "url": "https://github.com/vllm-project/vllm/releases/tag/v0.28.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "denial-of-service", + "multimodal", + "gpu", + "inference", + "vllm", + "draft-mapping" + ] + }, + { + "id": "INC-143", + "title": "vLLM: operator's model revision pin not applied to some processor, tokenizer and config loads", + "date": "2026-09", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Medium", + "description": "CVE-2026-100653 and the vLLM advisory GHSA-hhv2-872h-628q (published 2026-09-12) report that for the FunAudioChat and Tarsier2 architectures the operator-supplied --revision / --code-revision pin was not passed to the WhisperFeatureExtractor and speech_tokenizer loads in funaudiochat.py, or to the Qwen2VLConfig.from_pretrained call used by Tarsier2. Deployments pinned to a reviewed revision therefore still resolved these artifacts from the repository's default revision, so a later upstream change could alter audio preprocessing, speech tokenisation or Tarsier2 configuration without any change to the pin. The advisory calls this \"a supply-chain integrity and reproducibility failure for pinned deployments\" and states that \"It does not claim unauthenticated RCE or a `trust_remote_code=False` bypass.\"; it is residual to the earlier fix for GHSA-3ww4-5jv9-j5gm / CVE-2026-47155. Provenance, stated plainly: the CNA is VulnCheck, not the vendor. VulnCheck publishes a CVSS 3.1 score of 6.5 (Medium), the same score the vendor advisory carries, and a CVSS 4.0 score of 8.3 (High); this record transcribes the CVSS 3.1 severity because it is the one the vendor advisory and the CNA agree on. NVD lists both as secondary metrics and the record as Awaiting Analysis. The sources are inconsistent on the upper bound: the CVE text says \"from 0.22.1 through 0.28.0\" yet names 0.28.0 as the fix, and the advisory lists >= 0.22.1, <= 0.28.0 as affected with 0.28.0 as patched; it also says the lower bound may be as early as 0.21.0. The commit NVD lists as a reference is the earlier CVE-2026-47155 fix, not this one.", + "owasp_entries": [ + "LLM04" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L1", + "label": "Foundation Models", + "role": "origin", + "notes": "Processor, tokenizer and config artifacts resolved from the upstream repository's default branch" + }, + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "propagation", + "notes": "The serving engine's artifact loads drop the operator's revision pin" + } + ], + "attack_vector": "A change to the default branch of an upstream model repository is picked up by artifact loads that ignore the operator's revision pin", + "affected": "vLLM from 0.22.1, fixed in 0.28.0 (see the description on the stated range), FunAudioChat and Tarsier2 architectures", + "impact": "Pinned deployments load unreviewed processor, tokenizer or config artifacts, so model behaviour can change without any change to the pin", + "mitigations": [ + "Upgrade to vLLM 0.28.0 or later", + "Propagate the revision pin to every artifact a model loads, including processors, tokenizers and sub-configs", + "Serve production models from an internal mirror whose contents are integrity-verified" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-100653", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100653" + }, + { + "source": "GHSA", + "id": "GHSA-hhv2-872h-628q", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-100653", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100653", + "type": "advisory" + }, + { + "title": "vLLM security advisory GHSA-hhv2-872h-628q", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q", + "type": "advisory" + }, + { + "title": "VulnCheck advisory — vLLM incomplete artifact pin propagation (CNA record)", + "url": "https://www.vulncheck.com/advisories/vllm-0.22.1-before-0.28.0-incomplete-artifact-pin-propagation", + "type": "advisory" + }, + { + "title": "vLLM 0.28.0 release", + "url": "https://github.com/vllm-project/vllm/releases/tag/v0.28.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "model-supply-chain", + "artifact-pinning", + "vllm", + "draft-mapping" + ] + }, + { + "id": "INC-144", + "title": "SQLBot: spreadsheet upload wrote attacker-named files into the migration directory, run at next startup", + "date": "2026-06", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "High", + "description": "GHSA-wxv4-pw5w-wx79 / CVE-2026-53554, published by the SQLBot maintainers on 2026-06-09 with the 1.9.0 fix release, reports that the POST /api/v1/datasource/parseExcel endpoint of SQLBot — a text-to-SQL system built on LLMs and RAG — uses the client-supplied multipart filename when choosing where to store an upload, writes the content before spreadsheet parsing and validation finish, and can turn a double-extension filename into a Python source file. The advisory states that \"the upload handler trusts attacker-supplied filename information and allows it to influence the final storage location\", and that \"a failed upload request still produces a successful arbitrary file write.\" A module planted in /opt/sqlbot/app/alembic/versions/ is imported by Alembic, and its module-level code run, at the next startup or migration. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 4.0 score of 7.3 (High) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The repository advisory labels the issue High without a vector; this record transcribes the CNA's CVSS base severity.", + "owasp_entries": [ + "DSGAI12" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "origin", + "notes": "Datasource upload handler in the text-to-SQL application stores files under a client-chosen path" + } + ], + "attack_vector": "Crafted multipart filename on the spreadsheet-upload endpoint places a Python module in the Alembic migration directory", + "affected": "SQLBot before 1.9.0", + "impact": "Code execution in the SQLBot application runtime at the next startup or migration", + "mitigations": [ + "Upgrade to SQLBot 1.9.0 or later", + "Store uploads under server-generated names in a dedicated directory outside application code paths", + "Validate uploaded content before writing it to disk" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-53554", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53554" + }, + { + "source": "GHSA", + "id": "GHSA-wxv4-pw5w-wx79", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-wxv4-pw5w-wx79" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-53554", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53554", + "type": "advisory" + }, + { + "title": "SQLBot security advisory GHSA-wxv4-pw5w-wx79", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-wxv4-pw5w-wx79", + "type": "advisory" + }, + { + "title": "SQLBot 1.9.0 release", + "url": "https://github.com/dataease/SQLBot/releases/tag/v1.9.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "file-upload", + "code-execution", + "text-to-sql", + "sqlbot", + "draft-mapping" + ] + }, + { + "id": "INC-145", + "title": "SQLBot: SVG logo upload stored and served unsanitised, giving stored XSS in the application origin", + "date": "2026-06", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Medium", + "description": "GHSA-v23m-5pvq-xcgx / CVE-2026-53555, published by the SQLBot maintainers on 2026-06-09 with the 1.9.0 fix release, reports that an authenticated uploader can set an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and that \"The application accepts image/svg+xml uploads and stores uploaded SVG files without sanitization or validation.\" The file is served inline from the same origin through GET /api/v1/system/assistant/picture/{filename}, so script embedded in the SVG runs in the SQLBot web application when another user loads it, with access to the data and actions available to that user's session. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 4.0 score of 5.1 (Medium) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The repository advisory labels the issue High without a vector; this record transcribes the CNA's CVSS base severity.", + "owasp_entries": [ + "DSGAI12" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "origin", + "notes": "Assistant UI asset upload stored and served from the application origin without sanitisation" + } + ], + "attack_vector": "Authenticated user uploads an SVG containing script as the assistant UI logo; it executes in the browser of any user who loads it", + "affected": "SQLBot before 1.9.0", + "impact": "Script execution in other users' SQLBot sessions, with access to the data and actions available to them", + "mitigations": [ + "Upgrade to SQLBot 1.9.0 or later", + "Sanitise SVG uploads or convert them to raster images before storing", + "Serve user-uploaded files from a separate origin or with Content-Disposition: attachment and a restrictive CSP" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-53555", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53555" + }, + { + "source": "GHSA", + "id": "GHSA-v23m-5pvq-xcgx", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-53555", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53555", + "type": "advisory" + }, + { + "title": "SQLBot security advisory GHSA-v23m-5pvq-xcgx", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx", + "type": "advisory" + }, + { + "title": "SQLBot 1.9.0 release", + "url": "https://github.com/dataease/SQLBot/releases/tag/v1.9.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "xss", + "file-upload", + "text-to-sql", + "sqlbot", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.3.5", + "outcome": "absent", + "basis": "The application accepts image/svg+xml uploads and stores uploaded SVG files without sanitization or validation.", + "source_url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx", + "confirmed_by": [] + } + ] + }, + { + "id": "INC-146", + "title": "SQLBot: SQL injection in table preview read server files through the internal PostgreSQL superuser", + "date": "2026-06", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "Medium", + "description": "GHSA-vwjq-5h4h-x8g5 / CVE-2026-53556, published by the SQLBot maintainers on 2026-06-09 with the 1.9.0 fix release, reports a chain of three weaknesses behind POST /api/v1/datasource/previewData. The client-supplied table_name \"is incorporated into the generated SQL query without sufficient validation or safe identifier handling\"; the read-only policy blocks specific write operations but still permits a SELECT that calls pg_read_file(), pg_read_binary_file() or pg_ls_dir(); and the bundled PostgreSQL trusts loopback connections, which in testing \"successfully authenticated as the PostgreSQL root superuser even when an intentionally incorrect password was supplied\". An authenticated user who points a datasource at the internal instance can therefore read server files such as /etc/passwd through the API response, potentially exposing configuration, credentials and source code. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 4.0 score of 6.0 (Medium) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The repository advisory labels the issue High without a vector; this record transcribes the CNA's CVSS base severity.", + "owasp_entries": [ + "DSGAI12", + "DSGAI01" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L2", + "label": "Data Operations", + "role": "origin", + "notes": "Datasource preview in the text-to-SQL application builds SQL from a client-supplied identifier" + }, + { + "layer": "L6", + "label": "Security & Compliance", + "role": "propagation", + "notes": "Read-only filtering and loopback trust let the injected query run as database superuser" + } + ], + "attack_vector": "Crafted table_name in a previewData request against a datasource pointing at the internal PostgreSQL instance, invoking pg_read_file() inside a permitted SELECT", + "affected": "SQLBot before 1.9.0", + "impact": "Arbitrary file read from the application server, potentially exposing configuration, credentials, secrets and source code", + "mitigations": [ + "Upgrade to SQLBot 1.9.0 or later", + "Quote identifiers with the driver's identifier-escaping API or resolve them against the catalogue, never by string building", + "Connect to datasources with least-privilege roles and require password authentication on loopback" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-53556", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53556" + }, + { + "source": "GHSA", + "id": "GHSA-vwjq-5h4h-x8g5", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vwjq-5h4h-x8g5" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-53556", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53556", + "type": "advisory" + }, + { + "title": "SQLBot security advisory GHSA-vwjq-5h4h-x8g5", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vwjq-5h4h-x8g5", + "type": "advisory" + }, + { + "title": "SQLBot 1.9.0 release", + "url": "https://github.com/dataease/SQLBot/releases/tag/v1.9.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "sql-injection", + "file-disclosure", + "text-to-sql", + "sqlbot", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.2.4", + "outcome": "absent", + "basis": "The supplied `table_name` is incorporated into the generated SQL query without sufficient validation or safe identifier handling, allowing attacker-controlled SQL fragments to become part of the executed query.", + "source_url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vwjq-5h4h-x8g5", + "confirmed_by": [] + } + ] + }, + { + "id": "INC-147", + "title": "SQLBot: second-order SQL injection in datasource cleanup ran OS commands via COPY TO PROGRAM", + "date": "2026-06", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "High", + "description": "GHSA-vxwj-843f-9c9g / CVE-2026-53557, published by the SQLBot maintainers on 2026-06-09 with the 1.9.0 fix release, reports that an authenticated user can store a crafted sheet[\"tableName\"] value in an Excel datasource configuration submitted to POST /api/v1/datasource/. When the datasource is later deleted through DELETE /api/v1/datasource/{id}, \"this stored data is directly interpolated into SQL queries without parameterized query usage or proper escaping\", and the injected statement can use PostgreSQL's COPY TO PROGRAM to run operating-system commands with the privileges of the postgres process inside the SQLBot container. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 4.0 score of 7.7 (High) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The repository advisory labels the issue High without a vector; this record transcribes the CNA's CVSS base severity.", + "owasp_entries": [ + "DSGAI12" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L2", + "label": "Data Operations", + "role": "origin", + "notes": "Stored datasource configuration in the text-to-SQL application is interpolated into cleanup SQL" + }, + { + "layer": "L4", + "label": "Deployment & Infrastructure", + "role": "impact", + "notes": "Commands run inside the application container as the database process" + } + ], + "attack_vector": "Crafted sheet[\"tableName\"] stored with an Excel datasource and interpolated into SQL when the datasource is deleted, invoking COPY TO PROGRAM", + "affected": "SQLBot before 1.9.0", + "impact": "Operating-system command execution inside the SQLBot container with the privileges of the postgres process", + "mitigations": [ + "Upgrade to SQLBot 1.9.0 or later", + "Treat stored configuration as untrusted when it is reused in SQL — escape identifiers at use, not only at input", + "Run the application database role without superuser or pg_execute_server_program rights" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-53557", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53557" + }, + { + "source": "GHSA", + "id": "GHSA-vxwj-843f-9c9g", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vxwj-843f-9c9g" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-53557", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53557", + "type": "advisory" + }, + { + "title": "SQLBot security advisory GHSA-vxwj-843f-9c9g", + "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vxwj-843f-9c9g", + "type": "advisory" + }, + { + "title": "SQLBot 1.9.0 release", + "url": "https://github.com/dataease/SQLBot/releases/tag/v1.9.0", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "sql-injection", + "code-execution", + "text-to-sql", + "sqlbot", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.2.4", + "outcome": "absent", + "basis": "When the datasource is later deleted, this stored data is directly interpolated into SQL queries without parameterized query usage or proper escaping.", + "source_url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vxwj-843f-9c9g", + "confirmed_by": [] + } + ] + }, + { + "id": "INC-148", + "title": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", + "date": "2026-06", + "year": 2026, + "category": "research-demonstrated", + "incident_class": "tooling-cve", + "severity": "High", + "description": "GHSA-2xhg-73j7-rrgx / CVE-2026-53957, published by the Contentful MCP server maintainers on 2026-06-12, reports that the export_space and import_space tools in @contentful/mcp-tools \"accept LLM-controlled `host` and `proxy` parameters that are spread directly into the options object passed to `contentful-export` / `contentful-import`\", which combine them with the server's Contentful Management API personal access token. Once space_to_space_migration_handler has enabled the migration tools, a direct MCP call — or prompt injection through Contentful content the model reads — can send Management API requests, with their Authorization header, to an attacker-controlled host or proxy. The advisory notes that the other tools are unaffected because createToolClient pins the host from server configuration. A leaked token gives persistent out-of-band access to every Contentful space within its scope. The fix shipped in @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5 on 2026-06-01. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 3.1 score of 7.7 (High) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The GitHub-reviewed advisory database entry agrees with the CVE on the fixed versions; the repository advisory itself lists the versions it tested (<= 1.7.15 / <= 0.4.1) with no patched version.", + "owasp_entries": [ + "LLM01", + "ASI02", + "DSGAI02" + ], + "mapping_status": "draft", + "maestro_layers": [ + { + "layer": "L3", + "label": "Agent Frameworks", + "role": "origin", + "notes": "MCP tools expose network endpoint options to model-controlled arguments" + }, + { + "layer": "L6", + "label": "Security & Compliance", + "role": "impact", + "notes": "The server's management credential is attached to requests sent to the attacker's host" + } + ], + "attack_vector": "Direct MCP tool call, or prompt injection in Contentful content, sets the host or proxy argument of export_space or import_space, redirecting authenticated Management API requests", + "affected": "@contentful/mcp-server before 1.7.19 and @contentful/mcp-tools before 0.4.5", + "impact": "Exposure of the Contentful management token, giving persistent out-of-band access to every space within its scope", + "mitigations": [ + "Upgrade to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5 or later", + "Take network endpoints from server configuration, never from tool arguments the model can set", + "Scope MCP server credentials to the spaces the deployment needs, and rotate any token that may have been exposed" + ], + "external_refs": [ + { + "source": "CVE", + "id": "CVE-2026-53957", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53957" + }, + { + "source": "GHSA", + "id": "GHSA-2xhg-73j7-rrgx", + "url": "https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx" + } + ], + "references": [ + { + "title": "NVD — CVE-2026-53957", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53957", + "type": "advisory" + }, + { + "title": "Contentful MCP server security advisory GHSA-2xhg-73j7-rrgx", + "url": "https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx", + "type": "advisory" + }, + { + "title": "@contentful/mcp-server 1.7.19 release", + "url": "https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-server@1.7.19", + "type": "vendor" + }, + { + "title": "@contentful/mcp-tools 0.4.5 release", + "url": "https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-tools@0.4.5", + "type": "vendor" + } + ], + "tags": [ + "cve", + "ghsa", + "tooling-cve", + "mcp", + "prompt-injection", + "credential-exposure", + "ssrf", + "contentful", + "draft-evidence", + "draft-mapping" + ], + "control_failures": [ + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V1.3.6", + "outcome": "absent", + "basis": "`export_space` and `import_space` tools in `@contentful/mcp-tools` accept LLM-controlled `host` and `proxy` parameters that are spread directly into the options object passed to `contentful-export` / `contentful-import`.", + "source_url": "https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx", + "confirmed_by": [] + } + ] } ]; \ No newline at end of file From 6ea2cd600825af5e72229340f71343afccf05111 Mon Sep 17 00:00:00 2001 From: emmanuelgjr Date: Wed, 30 Sep 2026 23:16:11 -0400 Subject: [PATCH 2/2] Drop the SQLBot stored-XSS record (CVE-2026-53555) and renumber Maintainer decision: the stored XSS via an SVG logo upload qualifies as a CVE in GenAI tooling, but nothing about it is AI-specific and its only mapping (DSGAI12) rested on the product type, not the mechanism. It is removed, and the three records after it are renumbered so ids stay contiguous: INC-146 -> INC-145, INC-147 -> INC-146, INC-148 -> INC-147. No record referenced the old ids. Regenerated with generate.js + npm run stats. Co-Authored-By: Claude Opus 5.5 --- README.md | 2 +- data/entries/ASI02.json | 2 +- data/entries/DSGAI01.json | 2 +- data/entries/DSGAI02.json | 2 +- data/entries/DSGAI12.json | 14 ++----- data/entries/LLM01.json | 2 +- data/incidents.json | 84 +------------------------------------- data/stats.json | 10 ++--- docs/data.js | 22 ++++------ docs/incidents.js | 86 ++------------------------------------- 10 files changed, 27 insertions(+), 199 deletions(-) diff --git a/README.md b/README.md index 3f81956..e8d436c 100644 --- a/README.md +++ b/README.md @@ -82,7 +82,7 @@ Every file answers one question: **which controls from framework X address vulne | **70+** open-source tools | Catalogued and organised by function | | **25** eval profiles | Runnable Garak (13) + PyRIT (6) + LAAF (6) tests mapped to OWASP entries | | **26** compliance reports | Per-framework gap assessments auto-generated from data layer (MD, CSV, JSON, OSCAL) | -| **148** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) | +| **147** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) | | **LAAF v2.0** | First agentic LPCI red-teaming framework — fully integrated with 6-stage × OWASP crosswalk | All free. All open-source. Built for practitioners. diff --git a/data/entries/ASI02.json b/data/entries/ASI02.json index 98cb0b9..585136b 100644 --- a/data/entries/ASI02.json +++ b/data/entries/ASI02.json @@ -1284,7 +1284,7 @@ "name": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, - "incident_id": "INC-148" + "incident_id": "INC-147" } ], "crossrefs": { diff --git a/data/entries/DSGAI01.json b/data/entries/DSGAI01.json index 4d497ae..fda9aff 100644 --- a/data/entries/DSGAI01.json +++ b/data/entries/DSGAI01.json @@ -1215,7 +1215,7 @@ "name": "SQLBot: SQL injection in table preview read server files through the internal PostgreSQL superuser", "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, - "incident_id": "INC-146" + "incident_id": "INC-145" } ], "crossrefs": { diff --git a/data/entries/DSGAI02.json b/data/entries/DSGAI02.json index e7f63aa..208e419 100644 --- a/data/entries/DSGAI02.json +++ b/data/entries/DSGAI02.json @@ -1071,7 +1071,7 @@ "name": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, - "incident_id": "INC-148" + "incident_id": "INC-147" } ], "crossrefs": { diff --git a/data/entries/DSGAI12.json b/data/entries/DSGAI12.json index 9f99a2c..c75cf94 100644 --- a/data/entries/DSGAI12.json +++ b/data/entries/DSGAI12.json @@ -328,8 +328,8 @@ "evidence": { "confirmed": [], "drafted": [ - "INC-146", - "INC-147" + "INC-145", + "INC-146" ] } }, @@ -997,23 +997,17 @@ "year": 2026, "incident_id": "INC-144" }, - { - "name": "SQLBot: SVG logo upload stored and served unsanitised, giving stored XSS in the application origin", - "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", - "year": 2026, - "incident_id": "INC-145" - }, { "name": "SQLBot: SQL injection in table preview read server files through the internal PostgreSQL superuser", "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, - "incident_id": "INC-146" + "incident_id": "INC-145" }, { "name": "SQLBot: second-order SQL injection in datasource cleanup ran OS commands via COPY TO PROGRAM", "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, - "incident_id": "INC-147" + "incident_id": "INC-146" } ], "crossrefs": { diff --git a/data/entries/LLM01.json b/data/entries/LLM01.json index 8385e79..d412e54 100644 --- a/data/entries/LLM01.json +++ b/data/entries/LLM01.json @@ -1443,7 +1443,7 @@ "name": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, - "incident_id": "INC-148" + "incident_id": "INC-147" } ], "crossrefs": { diff --git a/data/incidents.json b/data/incidents.json index 0d31be6..6024d3a 100644 --- a/data/incidents.json +++ b/data/incidents.json @@ -9265,86 +9265,6 @@ }, { "id": "INC-145", - "title": "SQLBot: SVG logo upload stored and served unsanitised, giving stored XSS in the application origin", - "date": "2026-06", - "year": 2026, - "category": "research-demonstrated", - "incident_class": "tooling-cve", - "severity": "Medium", - "description": "GHSA-v23m-5pvq-xcgx / CVE-2026-53555, published by the SQLBot maintainers on 2026-06-09 with the 1.9.0 fix release, reports that an authenticated uploader can set an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and that \"The application accepts image/svg+xml uploads and stores uploaded SVG files without sanitization or validation.\" The file is served inline from the same origin through GET /api/v1/system/assistant/picture/{filename}, so script embedded in the SVG runs in the SQLBot web application when another user loads it, with access to the data and actions available to that user's session. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 4.0 score of 5.1 (Medium) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The repository advisory labels the issue High without a vector; this record transcribes the CNA's CVSS base severity.", - "owasp_entries": [ - "DSGAI12" - ], - "mapping_status": "draft", - "maestro_layers": [ - { - "layer": "L4", - "label": "Deployment & Infrastructure", - "role": "origin", - "notes": "Assistant UI asset upload stored and served from the application origin without sanitisation" - } - ], - "attack_vector": "Authenticated user uploads an SVG containing script as the assistant UI logo; it executes in the browser of any user who loads it", - "affected": "SQLBot before 1.9.0", - "impact": "Script execution in other users' SQLBot sessions, with access to the data and actions available to them", - "mitigations": [ - "Upgrade to SQLBot 1.9.0 or later", - "Sanitise SVG uploads or convert them to raster images before storing", - "Serve user-uploaded files from a separate origin or with Content-Disposition: attachment and a restrictive CSP" - ], - "external_refs": [ - { - "source": "CVE", - "id": "CVE-2026-53555", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53555" - }, - { - "source": "GHSA", - "id": "GHSA-v23m-5pvq-xcgx", - "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx" - } - ], - "references": [ - { - "title": "NVD — CVE-2026-53555", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53555", - "type": "advisory" - }, - { - "title": "SQLBot security advisory GHSA-v23m-5pvq-xcgx", - "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx", - "type": "advisory" - }, - { - "title": "SQLBot 1.9.0 release", - "url": "https://github.com/dataease/SQLBot/releases/tag/v1.9.0", - "type": "vendor" - } - ], - "tags": [ - "cve", - "ghsa", - "tooling-cve", - "xss", - "file-upload", - "text-to-sql", - "sqlbot", - "draft-evidence", - "draft-mapping" - ], - "control_failures": [ - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V1.3.5", - "outcome": "absent", - "basis": "The application accepts image/svg+xml uploads and stores uploaded SVG files without sanitization or validation.", - "source_url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx", - "confirmed_by": [] - } - ] - }, - { - "id": "INC-146", "title": "SQLBot: SQL injection in table preview read server files through the internal PostgreSQL superuser", "date": "2026-06", "year": 2026, @@ -9431,7 +9351,7 @@ ] }, { - "id": "INC-147", + "id": "INC-146", "title": "SQLBot: second-order SQL injection in datasource cleanup ran OS commands via COPY TO PROGRAM", "date": "2026-06", "year": 2026, @@ -9517,7 +9437,7 @@ ] }, { - "id": "INC-148", + "id": "INC-147", "title": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", "date": "2026-06", "year": 2026, diff --git a/data/stats.json b/data/stats.json index e519c16..f036f78 100644 --- a/data/stats.json +++ b/data/stats.json @@ -61,16 +61,16 @@ } }, "incidents": { - "total": 148 + "total": 147 }, "evidence": { - "incidents_annotated": 25, - "control_failures": 35, + "incidents_annotated": 24, + "control_failures": 34, "confirmed": 0, - "drafted": 35, + "drafted": 34, "mappings_with_confirmed_evidence": 0, "mappings_with_drafted_evidence_only": 28, - "orphan_failures": 8 + "orphan_failures": 7 }, "freshness": { "checked": 5, diff --git a/docs/data.js b/docs/data.js index e3a72b0..e529169 100644 --- a/docs/data.js +++ b/docs/data.js @@ -1447,7 +1447,7 @@ window.CROSSWALK_DATA = [ "name": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, - "incident_id": "INC-148" + "incident_id": "INC-147" } ], "crossrefs": { @@ -15565,7 +15565,7 @@ window.CROSSWALK_DATA = [ "name": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, - "incident_id": "INC-148" + "incident_id": "INC-147" } ], "crossrefs": { @@ -26442,7 +26442,7 @@ window.CROSSWALK_DATA = [ "name": "SQLBot: SQL injection in table preview read server files through the internal PostgreSQL superuser", "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, - "incident_id": "INC-146" + "incident_id": "INC-145" } ], "crossrefs": { @@ -27542,7 +27542,7 @@ window.CROSSWALK_DATA = [ "name": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, - "incident_id": "INC-148" + "incident_id": "INC-147" } ], "crossrefs": { @@ -36987,8 +36987,8 @@ window.CROSSWALK_DATA = [ "evidence": { "confirmed": [], "drafted": [ - "INC-146", - "INC-147" + "INC-145", + "INC-146" ] } }, @@ -37656,23 +37656,17 @@ window.CROSSWALK_DATA = [ "year": 2026, "incident_id": "INC-144" }, - { - "name": "SQLBot: SVG logo upload stored and served unsanitised, giving stored XSS in the application origin", - "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", - "year": 2026, - "incident_id": "INC-145" - }, { "name": "SQLBot: SQL injection in table preview read server files through the internal PostgreSQL superuser", "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, - "incident_id": "INC-146" + "incident_id": "INC-145" }, { "name": "SQLBot: second-order SQL injection in datasource cleanup ran OS commands via COPY TO PROGRAM", "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json", "year": 2026, - "incident_id": "INC-147" + "incident_id": "INC-146" } ], "crossrefs": { diff --git a/docs/incidents.js b/docs/incidents.js index 50eab4d..a277b09 100644 --- a/docs/incidents.js +++ b/docs/incidents.js @@ -1,5 +1,5 @@ // Auto-generated by scripts/generate.js — do not edit manually -// Incidents: 148 +// Incidents: 147 window.CROSSWALK_INCIDENTS = [ { "id": "INC-001", @@ -9263,86 +9263,6 @@ window.CROSSWALK_INCIDENTS = [ }, { "id": "INC-145", - "title": "SQLBot: SVG logo upload stored and served unsanitised, giving stored XSS in the application origin", - "date": "2026-06", - "year": 2026, - "category": "research-demonstrated", - "incident_class": "tooling-cve", - "severity": "Medium", - "description": "GHSA-v23m-5pvq-xcgx / CVE-2026-53555, published by the SQLBot maintainers on 2026-06-09 with the 1.9.0 fix release, reports that an authenticated uploader can set an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and that \"The application accepts image/svg+xml uploads and stores uploaded SVG files without sanitization or validation.\" The file is served inline from the same origin through GET /api/v1/system/assistant/picture/{filename}, so script embedded in the SVG runs in the SQLBot web application when another user loads it, with access to the data and actions available to that user's session. Provenance: the CNA is GitHub, acting on the maintainers' advisory; the CVSS 4.0 score of 5.1 (Medium) is that CNA's score, carried by NVD as a secondary metric, and NVD lists the record as Deferred with no score of its own. The repository advisory labels the issue High without a vector; this record transcribes the CNA's CVSS base severity.", - "owasp_entries": [ - "DSGAI12" - ], - "mapping_status": "draft", - "maestro_layers": [ - { - "layer": "L4", - "label": "Deployment & Infrastructure", - "role": "origin", - "notes": "Assistant UI asset upload stored and served from the application origin without sanitisation" - } - ], - "attack_vector": "Authenticated user uploads an SVG containing script as the assistant UI logo; it executes in the browser of any user who loads it", - "affected": "SQLBot before 1.9.0", - "impact": "Script execution in other users' SQLBot sessions, with access to the data and actions available to them", - "mitigations": [ - "Upgrade to SQLBot 1.9.0 or later", - "Sanitise SVG uploads or convert them to raster images before storing", - "Serve user-uploaded files from a separate origin or with Content-Disposition: attachment and a restrictive CSP" - ], - "external_refs": [ - { - "source": "CVE", - "id": "CVE-2026-53555", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53555" - }, - { - "source": "GHSA", - "id": "GHSA-v23m-5pvq-xcgx", - "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx" - } - ], - "references": [ - { - "title": "NVD — CVE-2026-53555", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53555", - "type": "advisory" - }, - { - "title": "SQLBot security advisory GHSA-v23m-5pvq-xcgx", - "url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx", - "type": "advisory" - }, - { - "title": "SQLBot 1.9.0 release", - "url": "https://github.com/dataease/SQLBot/releases/tag/v1.9.0", - "type": "vendor" - } - ], - "tags": [ - "cve", - "ghsa", - "tooling-cve", - "xss", - "file-upload", - "text-to-sql", - "sqlbot", - "draft-evidence", - "draft-mapping" - ], - "control_failures": [ - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V1.3.5", - "outcome": "absent", - "basis": "The application accepts image/svg+xml uploads and stores uploaded SVG files without sanitization or validation.", - "source_url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx", - "confirmed_by": [] - } - ] - }, - { - "id": "INC-146", "title": "SQLBot: SQL injection in table preview read server files through the internal PostgreSQL superuser", "date": "2026-06", "year": 2026, @@ -9429,7 +9349,7 @@ window.CROSSWALK_INCIDENTS = [ ] }, { - "id": "INC-147", + "id": "INC-146", "title": "SQLBot: second-order SQL injection in datasource cleanup ran OS commands via COPY TO PROGRAM", "date": "2026-06", "year": 2026, @@ -9515,7 +9435,7 @@ window.CROSSWALK_INCIDENTS = [ ] }, { - "id": "INC-148", + "id": "INC-147", "title": "Contentful MCP server: LLM-controlled host argument sent the management token to an attacker endpoint", "date": "2026-06", "year": 2026,