AI Security Threat Feed

label-studio-ml: PyTorch .pt deserialization RCE in YOLO loader

transformers: ReDoS in testing_utils causes DoS

Label Studio: XSS enables unauthorized actions via CSRF

llama_index: DoS via uncapped recursion in web reader

TensorFlow Serving: JSON recursion DoS on inference API

vLLM: pickle RCE in multi-node inference deployments

LLaMA-Factory: RCE via torch.load() unsafe deserialization

vLLM: DoS via quadratic multimodal tokenizer input

vLLM: ZeroMQ socket exposure enables DoS in multi-node

picklescan: scanner bypass enables DNS data exfiltration

jupyterlab-git: command injection via malicious repo name

Mesop: class pollution enables DoS and LLM jailbreak

litellm: privilege escalation viewer→proxy admin via bad API key

LiteLLM: Langfuse API key leak via error handling

open-webui: DoS via unauthenticated multipart parsing

LiteLLM: API key leakage in logs exposes credentials

litellm: unauthenticated DoS via multipart boundary parsing

Open-WebUI: unauthenticated PDF endpoint enables DoS

open-webui: unauthenticated DoS via markdown parser

open-webui: Stored XSS enables admin session hijack