Monthly
Prompt injection in Amazon Strands Agents Tools before 0.8.0 enables remote actors to execute arbitrary OS commands on the agent's host by crafting input that sets the shell tool's `non_interactive` parameter to `true`, silencing the human consent gate designed to require approval before running shell commands. The CVSS 4.0 vector (AV:N/PR:N) confirms no attacker authentication is required, though the agent must actively process the malicious prompt (UI:A) and the shell tool must be in use (AT:P). No public exploit code or CISA KEV listing has been identified at time of analysis.
Indirect prompt injection in Eclipse Theia versions prior to 1.71.0 allows attackers who control a workspace's filesystem layout to coerce the built-in AI chat agent into executing attacker-supplied instructions, enabling data exfiltration through Markdown image rendering or arbitrary command execution through task definitions. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.4 reflects high impact across confidentiality, integrity and availability once a developer opens an untrusted repository. The flaw is reported by the Eclipse Foundation and fixed in version 1.71.0.
Agentic workflow injection in nnU-Net's GitHub Actions issue-triage automation (prior to 2.4.1) lets any logged-in GitHub user hijack a command-capable Claude agent by opening a crafted issue. Because the workflow embeds untrusted issue title/body directly into the LLM prompt and grants the agent authenticated gh permissions to comment and relabel issues, an external attacker can steer it beyond triage into performing repository actions on their behalf. A proof-of-concept is indicated (SSVC exploitation=poc), but EPSS is very low (0.04%) and it is not in CISA KEV, so no active exploitation is confirmed.
Prompt injection in 1millionbot Millie chatbot allows remote attackers to bypass chat restrictions using Boolean logic techniques, enabling retrieval of prohibited information and execution of unintended tasks including potential abuse of OpenAI API keys. The vulnerability exploits insufficient input validation in the LLM's containment mechanisms, permitting attackers to reformulate queries in ways that trigger affirmative responses ('true') that then execute injected instructions outside the chatbot's intended scope.
Prompt injection in Microsoft Edge for iOS exposes users to network-based spoofing attacks through Microsoft Edge's AI/Copilot integration. Malicious web content can embed adversarial LLM prompts that, when processed by Edge's AI features, manipulate the model to produce spoofed or misleading output - potentially impersonating trusted content or bypassing AI-enforced guardrails. The CVSS vector (PR:N/UI:R) indicates no attacker authentication is required, but a user must interact with Edge on iOS while AI features are active. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Indirect prompt injection in HCL AION v2.5.0 enables authenticated network attackers to embed HTML markup into AI-generated rendered output, which may then be displayed to other platform users and trigger unintended browser behavior. Classified under CWE-1427 - a category specific to AI/LLM output sanitization failures - the vulnerability carries a vendor-assigned CVSS 4.3 Medium rating reflecting limited confidentiality impact and an authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in GitLab Enterprise Edition's AI-assisted code review feature allows authenticated users to access data from projects they are not authorized to view. Affected versions are 19.1.x before 19.1.3 and 19.2.x before 19.2.1. An attacker with any level of authenticated access can craft malicious code content that, when processed by the AI review engine, causes the model to return information from unauthorized projects - a classic prompt injection boundary-crossing attack. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Prompt injection in Amazon Strands Agents Tools before 0.8.0 enables remote actors to execute arbitrary OS commands on the agent's host by crafting input that sets the shell tool's `non_interactive` parameter to `true`, silencing the human consent gate designed to require approval before running shell commands. The CVSS 4.0 vector (AV:N/PR:N) confirms no attacker authentication is required, though the agent must actively process the malicious prompt (UI:A) and the shell tool must be in use (AT:P). No public exploit code or CISA KEV listing has been identified at time of analysis.
Indirect prompt injection in Eclipse Theia versions prior to 1.71.0 allows attackers who control a workspace's filesystem layout to coerce the built-in AI chat agent into executing attacker-supplied instructions, enabling data exfiltration through Markdown image rendering or arbitrary command execution through task definitions. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.4 reflects high impact across confidentiality, integrity and availability once a developer opens an untrusted repository. The flaw is reported by the Eclipse Foundation and fixed in version 1.71.0.
Agentic workflow injection in nnU-Net's GitHub Actions issue-triage automation (prior to 2.4.1) lets any logged-in GitHub user hijack a command-capable Claude agent by opening a crafted issue. Because the workflow embeds untrusted issue title/body directly into the LLM prompt and grants the agent authenticated gh permissions to comment and relabel issues, an external attacker can steer it beyond triage into performing repository actions on their behalf. A proof-of-concept is indicated (SSVC exploitation=poc), but EPSS is very low (0.04%) and it is not in CISA KEV, so no active exploitation is confirmed.
Prompt injection in 1millionbot Millie chatbot allows remote attackers to bypass chat restrictions using Boolean logic techniques, enabling retrieval of prohibited information and execution of unintended tasks including potential abuse of OpenAI API keys. The vulnerability exploits insufficient input validation in the LLM's containment mechanisms, permitting attackers to reformulate queries in ways that trigger affirmative responses ('true') that then execute injected instructions outside the chatbot's intended scope.
Prompt injection in Microsoft Edge for iOS exposes users to network-based spoofing attacks through Microsoft Edge's AI/Copilot integration. Malicious web content can embed adversarial LLM prompts that, when processed by Edge's AI features, manipulate the model to produce spoofed or misleading output - potentially impersonating trusted content or bypassing AI-enforced guardrails. The CVSS vector (PR:N/UI:R) indicates no attacker authentication is required, but a user must interact with Edge on iOS while AI features are active. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Indirect prompt injection in HCL AION v2.5.0 enables authenticated network attackers to embed HTML markup into AI-generated rendered output, which may then be displayed to other platform users and trigger unintended browser behavior. Classified under CWE-1427 - a category specific to AI/LLM output sanitization failures - the vulnerability carries a vendor-assigned CVSS 4.3 Medium rating reflecting limited confidentiality impact and an authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in GitLab Enterprise Edition's AI-assisted code review feature allows authenticated users to access data from projects they are not authorized to view. Affected versions are 19.1.x before 19.1.3 and 19.2.x before 19.2.1. An attacker with any level of authenticated access can craft malicious code content that, when processed by the AI review engine, causes the model to return information from unauthorized projects - a classic prompt injection boundary-crossing attack. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.