Loading story…
Cybersecurity researchers have identified a chain of critical remote code execution (RCE) vulnerabilities affecting major AI inference server frameworks, including those from Meta, Nvidia, Microsoft, and open-source projects such as vLLM and SGLang. The root cause of these vulnerabilities is the unsafe use of ZeroMQ (ZMQ) in combination with Python's pickle deserialization, which was propagated across multiple projects due to direct code copying. This insecure pattern, first observed in Meta's Llama Stack, allowed arbitrary code execution over unauthenticated sockets and was subsequently found in other frameworks, exposing enterprise AI stacks to systemic risk. The vulnerabilities have been assigned CVE-2024-50050 and have been patched in affected projects, but the incident highlights the dangers of code reuse without proper security review.
Oligo Security's investigation revealed that the same vulnerable logic was copied line-for-line between projects, perpetuating the flaw across different ecosystems and maintainers. The issue underscores a systemic security gap in the rapidly evolving AI inference ecosystem, where insecure patterns can quickly become widespread through open-source collaboration and code sharing. Security experts emphasize the need for rigorous security audits and caution when reusing code, especially in critical infrastructure like AI frameworks, to prevent similar vulnerabilities from proliferating in the future.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository published proof-of-concept exploitation details for CVE-2026-5760 in SGLang 0.5.9, showing how a malicious GGUF model file can trigger server-side template injection and remote code execution via the /v1/rerank endpoint. The PoC identified unsandboxed Jinja2 rendering in serving_rerank.py and demonstrated command execution when a crafted model is loaded and invoked.
CERT/CC published VU#915947 warning that SGLang is vulnerable to remote code execution when rendering chat templates from a model file. This is a separate disclosure from the previously documented copy-paste flaws in other AI inference frameworks.
Security researchers reported a set of 'copy-paste' vulnerabilities affecting AI inference frameworks associated with Meta, Nvidia, and Microsoft. The flaws were described as serious bugs that could expose users or systems relying on those frameworks.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcekb.cert.org
Open sourcegithub.com
Open sourcecsoonline.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple high-severity deserialization vulnerabilities have been identified in widely used AI and analytics frameworks, including NVIDIA Isaac Lab, MooreThreads torch_musa, and NVIDIA Merlin components. These flaws allow attackers to exploit unsafe deserialization processes, potentially leading to remote code execution or denial-of-service conditions on affected systems. In the case of MooreThreads torch_musa, the vulnerability arises from the use of `pickle.load()` on user-controlled files without validation, enabling arbitrary code execution with the privileges of the victim process. Similarly, NVIDIA Isaac Lab and Merlin frameworks are affected by deserialization issues that could be exploited remotely, with Merlin's NVTabular and Transformers4Rec components specifically highlighted for their susceptibility to code execution and data tampering attacks. Security advisories urge immediate patching, as these vulnerabilities are remotely exploitable and pose significant risks to enterprise environments. The affected products span various versions, and organizations using these frameworks are advised to review vendor guidance and apply available security updates to mitigate the threat. The vulnerabilities have been assigned high or critical CVSS scores, underscoring the urgency for remediation to prevent potential exploitation in production environments.
Jun 29, 2026
Security researchers have disclosed over 30 vulnerabilities in a range of AI-powered Integrated Development Environments (IDEs) and coding assistants, collectively named 'IDEsaster.' These flaws, affecting popular tools such as Cursor, Windsurf, Kiro.dev, GitHub Copilot, Zed.dev, Roo Code, Junie, and Cline, allow attackers to chain prompt injection techniques with legitimate IDE features to achieve data exfiltration and remote code execution (RCE). The vulnerabilities exploit the fact that AI agents integrated into these environments can autonomously perform actions, bypassing traditional security boundaries and enabling attackers to hijack context, trigger unauthorized tool calls, and execute arbitrary commands. At least 24 of these vulnerabilities have been assigned CVE identifiers, highlighting the widespread and systemic nature of the risk. The research emphasizes that the integration of AI agents into development workflows introduces new attack surfaces, as these agents often operate with elevated privileges and insufficient threat modeling. Notably, the issues differ from previous prompt injection attacks by leveraging the AI agent's ability to activate legitimate IDE features for malicious purposes. Additional reporting confirms that critical CVEs have been issued for these tools, and broader industry analysis warns that nearly half of all AI-generated code contains exploitable flaws, with a particularly high vulnerability rate in Java. The findings underscore the urgent need for organizations using AI-driven development tools to reassess their security postures and apply available patches to mitigate the risk of data theft and RCE attacks.
Jun 29, 2026
Microsoft disclosed two critical vulnerabilities in its **Semantic Kernel** AI agent framework that could let prompt injection escalate into host compromise. `CVE-2026-26030` affected the Python implementation before version `1.39.4`, where unsafe `eval()`-based lambda construction in the Search Plugin’s default In-Memory Vector Store filter path enabled remote code execution, while `CVE-2026-25592` affected the .NET SDK before version `1.71.0` and allowed arbitrary file write through `SessionsPythonPlugin`’s `DownloadFileAsync`, creating a path to sandbox escape and host takeover; a related arbitrary file read issue was also present in upload handling. Microsoft said it hardened AST validation, restricted callable functions and attributes, removed unintended tool exposure, added path validation, and urged customers to patch and review endpoint telemetry for signs of exploitation. The disclosure lands amid broader warnings that AI agents can preserve and amplify malicious instructions through memory and context reuse. Cisco researchers recently showed that poisoned memory files in Anthropic’s **Claude Code** could persist across projects and sessions, steering the assistant to insert hard-coded secrets, choose insecure packages and configurations, and spread tainted changes to another developer. Researchers and defenders say the incidents reinforce that AI models are not security boundaries and that any model-influenced tool parameter, memory file, or context artifact should be treated as attacker-controlled input, with mitigations including patching vulnerable frameworks, scanning memory and dependency files, and purging stored agent memory after suspected compromise.
Jun 29, 2026