What is the CVSS score of CVE-2026-41512?

CVE-2026-41512 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of ai-scanner are affected by CVE-2026-41512?

CVE-2026-41512 is a critical remote code execution vulnerability in ai-scanner versions 1.0.0-1.4.0 that allows authenticated users to execute arbitrary code, potentially compromising all systems…. A patch is available.

How to fix or mitigate CVE-2026-41512?

Within 24 hours: Identify all systems running ai-scanner versions 1.0.0-1.4.0 and isolate them from production networks if immediate patching is impossible. Within 7 days: Upgrade all instances to ai-scanner version 1.4.1 or later per the vendor advisory (GHSA-r27j-xxgx-f5vr). Within 30 days: Conduct audit of ai-scanner account access logs to detect potential exploitation and review all JavaScript executed through BrowserAutomation::PlaywrightService for malicious modifications.

ai-scanner CVE-2026-41512

EUVD-2026-28599 CRITICAL

Code Injection (CWE-94)

2026-05-08 security-advisories@github.com

Nvidia Code Injection RCE

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 08, 2026 - 15:02 EUVD

Source Code Evidence Fetched

May 08, 2026 - 14:32 vuln.today

Analysis Generated

May 08, 2026 - 14:32 vuln.today

CVE Published

May 08, 2026 - 14:16 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in BrowserAutomation::PlaywrightService. This issue has been patched in version 1.4.1.

AnalysisAI

Remote code execution in ai-scanner versions 1.0.0 through 1.4.0 allows authenticated attackers to inject and execute arbitrary JavaScript code via the BrowserAutomation::PlaywrightService component. The vulnerability has a Critical CVSS score of 9.9 with scope change, enabling cross-boundary compromise of confidentiality, integrity, and availability. Vendor-released patch available in version 1.4.1 as of April 13, 2026, with GitHub Security Advisory GHSA-r27j-xxgx-f5vr confirming the fix.

Technical ContextAI

The vulnerability resides in ai-scanner, an AI model safety scanning tool built on NVIDIA garak framework. The flaw is a CWE-94 code injection weakness in the BrowserAutomation::PlaywrightService module, which likely handles browser automation testing via Microsoft's Playwright framework. The service appears to improperly sanitize or validate JavaScript input before execution in browser contexts, allowing attackers to break out of intended execution boundaries. The CVSS scope change (S:C) indicates the vulnerable component can affect resources beyond its security scope, suggesting the Playwright service operates with elevated privileges or can access adjacent trust domains within the AI scanning infrastructure.

RemediationAI

Upgrade immediately to ai-scanner version 1.4.1 released April 13, 2026, which applies security hardening to the BrowserAutomation::PlaywrightService component per GitHub issue #16. Download from https://github.com/0din-ai/ai-scanner/releases/tag/v1.4.1 and verify release integrity before deployment. If immediate patching is not feasible, implement compensating controls: restrict network access to the ai-scanner service to trusted IP ranges only via firewall rules; enforce strong authentication with MFA for all service accounts; disable or restrict access to browser automation features if not required for current scanning operations (trade-off: reduced testing coverage for browser-based AI model interfaces); deploy the service in an isolated network segment with egress filtering to limit post-exploitation lateral movement; enable comprehensive audit logging for all BrowserAutomation service invocations to detect injection attempts. Review access logs for versions 1.0.0-1.4.0 for suspicious JavaScript patterns in automation parameters as potential IOCs.