Decepticon EUVD-2026-86329

Requires the BYOK deployment model where the operator has configured a self-hosted / OpenAI-compatible LLM backend (vLLM, SGLang, TGI, Ollama, LM Studio, text-generation-webui) whose tokenizer preserves special-token literal IDs in user content - the default for most such backends. Exploitation additionally requires that the operator direct Decepticon's reconnaissance crawler at attacker-controlled or attacker-compromised web content, which is normal operation for a red-team tool scanning untrusted targets. LIMITING FACTORS: deployments using hosted providers (OpenAI, Anthropic) are NOT vulnerable because those strip special tokens server-side; only Decepticon versions prior to 1.1.17 are affected; and the attacker cannot exploit unless a red-teamer actually crawls their planted content.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) presents this as a maximally critical unauthenticated remote code execution flaw, but several signals argue for tempering that raw score. There is no CISA KEV listing, no EPSS score supplied, and no public exploit code referenced in the intelligence - so exploitation status is 'no public exploit identified at time of analysis.' More importantly, exploitability is heavily conditioned on deployment: the vendor's own patch commentary (GHSA-g5f9-3xfg-p9mf) states that hosted providers (OpenAI, Anthropic) strip special-token literals server-side and are therefore NOT affected, and the flaw only fires under the BYOK model with a self-hosted / OpenAI-compatible backend (vLLM, SGLang, TGI, Ollama, LM Studio, text-generation-webui) whose tokenizer preserves special-token IDs. That dependency on a specific, non-universal backend configuration means AC:L is arguably understated - I assess AC:H (CVSS 4.0 AT:P). The impact is real and severe where the preconditions hold (guardrail bypass leading to arbitrary command execution in the Kali sandbox), but the affected product is a niche red-team tool, so real-world priority is bounded by very low prevalence rather than by the perfect 10.0. Net: a genuine critical for the specific population running Decepticon <1.1.17 against untrusted targets with a self-hosted model, not a broad-fleet emergency.

An attacker plants a ChatML/Llama/Gemma/Mistral special-token literal (e.g. <|im_start|> or [INST]) inside a web page hosted on a service that a red-teamer will point Decepticon at. When Decepticon's reconnaissance crawler ingests the page and wraps the result into an LLM message, a self-hosted tokenizer parses the literal into a structural role-boundary token, forging an authoritative operator/system turn that overrides the agent's quarantine guardrails and drives arbitrary command execution inside the Kali Linux sandbox. No public exploit code is referenced, though the mechanism is well-documented in the vendor advisory and patch tests.