EUVD-2026-16933Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The impacted element is the function _route_using_overviews of the file backend/server.py of the component LLM Prompt Handler. Such manipulation leads to injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Prompt injection in PromtEngineer localGPT allows unauthenticated remote attackers to manipulate LLM behavior via crafted inputs to the _route_using_overviews function. Publicly available exploit code exists (GitHub). The vulnerability affects all versions up to commit 4d41c7d17, with CVSS 7.3 indicating moderate confidentiality, integrity, and availability impact. EPSS data not available, but the combination of network-accessible attack vector, low complexity (AC:L), no authentication requirement (PR:N), and public POC elevates real-world risk for installations exposed to untrusted input.
Technical ContextAI
This is a CWE-74 injection vulnerability in localGPT, a privacy-focused document question-answering system using Large Language Models. The flaw exists in the _route_using_overviews function within backend/server.py, which handles routing logic for LLM prompt processing. Prompt injection attacks exploit insufficient input validation in LLM integrations, allowing attackers to embed malicious instructions within user queries that override intended system behavior. Unlike traditional injection attacks (SQL, command), prompt injection manipulates the semantic interpretation of natural language prompts, potentially causing the LLM to disclose training data, execute unintended operations, or bypass safety controls. The affected component appears to process document overviews or routing decisions based on user-supplied prompts without adequate sanitization or sandboxing of instructions.
RemediationAI
No vendor-released patch identified at time of analysis, as the vendor did not respond to disclosure attempts. Users should immediately review the GitHub repository (https://github.com/PromtEngineer/localGPT) for commits addressing backend/server.py input validation after commit 4d41c7d17. If no patch exists, implement application-level workarounds: restrict network access to localGPT endpoints to trusted IP ranges, deploy web application firewalls with prompt injection detection rules, implement strict input validation and sanitization before prompt processing, and enforce principle of least privilege for LLM tool access. Consider disabling the _route_using_overviews function if not critical to operations. Monitor application logs for anomalous prompt patterns (e.g., system instructions, role-switching attempts). Evaluate migration to actively maintained LLM frameworks with built-in prompt injection defenses. Refer to VulDB advisory (https://vuldb.com/vuln/353889) and POC repository (https://github.com/August829/CVEP/issues/9) for technical details to inform defensive measures.
Unrestricted file upload in PromtEngineer localGPT allows remote attackers to upload arbitrary files via the do_POST fun
Authentication bypass in PromtEngineer localGPT affects the LocalGPTHandler API endpoint in backend/server.py, allowing
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today