Void
Monthly
Path traversal via prompt injection in Void editor through 1.3.4 allows network attackers who can deliver malicious content into the AI agent's processing context to silently read arbitrary host files outside the open workspace, including SSH private keys and cloud credentials. The AI agent's file-reading tools (read_file, ls_dir, get_dir_tree, search_*) accept absolute filesystem paths and file:// URIs without workspace confinement and bypass the built-in approval gate, enabling silent exfiltration. No CISA KEV listing exists, but a publicly available proof-of-concept exploit has been published, confirming exploitability; the AC:H rating reflects the prompt injection prerequisite rather than any technical barrier once malicious content is ingested.
An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Path traversal via prompt injection in Void editor through 1.3.4 allows network attackers who can deliver malicious content into the AI agent's processing context to silently read arbitrary host files outside the open workspace, including SSH private keys and cloud credentials. The AI agent's file-reading tools (read_file, ls_dir, get_dir_tree, search_*) accept absolute filesystem paths and file:// URIs without workspace confinement and bypass the built-in approval gate, enabling silent exfiltration. No CISA KEV listing exists, but a publicly available proof-of-concept exploit has been published, confirming exploitability; the AC:H rating reflects the prompt injection prerequisite rather than any technical barrier once malicious content is ingested.
An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.