What is the CVSS score of CVE-2026-41512?

CVE-2026-41512 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of ai-scanner are affected by CVE-2026-41512?

CVE-2026-41512 is a critical remote code execution vulnerability in ai-scanner versions 1.0.0-1.4.0 that allows authenticated users to execute arbitrary code, potentially compromising all systems…. A patch is available.

ai-scanner CVE-2026-41512

EUVD-2026-28599 CRITICAL

Code Injection (CWE-94)

2026-05-08 security-advisories@github.com

RCE Code Injection Nvidia

9.9

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 08, 2026 - 15:02 EUVD

Source Code Evidence Fetched

May 08, 2026 - 14:32 vuln.today

Analysis Generated

May 08, 2026 - 14:32 vuln.today

CVE Published

May 08, 2026 - 14:16 nvd

CRITICAL 9.9

DescriptionNVD

ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in BrowserAutomation::PlaywrightService. This issue has been patched in version 1.4.1.

AnalysisAI

Remote code execution in ai-scanner versions 1.0.0 through 1.4.0 allows authenticated attackers to inject and execute arbitrary JavaScript code via the BrowserAutomation::PlaywrightService component. The vulnerability has a Critical CVSS score of 9.9 with scope change, enabling cross-boundary compromise of confidentiality, integrity, and availability. …

RemediationAI

Within 24 hours: Identify all systems running ai-scanner versions 1.0.0-1.4.0 and isolate them from production networks if immediate patching is impossible. Within 7 days: Upgrade all instances to ai-scanner version 1.4.1 or later per the vendor advisory (GHSA-r27j-xxgx-f5vr). …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory