NEWSkillSec — elevating AI Skills security from malware detection to capability auditingSkillSecLearn more →
← Back to Intel Center
SECURITY INTEL · DAILY
RSS

2026-09-11 ~ 09-13 Daily Security Intelligence

CSSA 2 · CVE 2 · Poison 2

10.0 Critical · CVE-2026-13745 Gemini CLI .env overwrite of GEMINI_CLI_HOME lea…

CSSA Exclusive Early Warning 2

CSSA Exclusive Early Warning 9.9 Critical

convex-backend crafted deployment selector bypasses production authorization leading to remote privileged execution

An attacker exploits a defect in the MCP server's validation logic for the deployment selector `kind` field by constructing a non-standard production-environment selector via name or reference, thereby bypassing the security guard that applies only to `kind: "prod"`. The vulnerability allows high-risk mutation tools such as `run` and `envSet` to be invoked directly without the dangerous production-deployment flag enabled, exposing the production environment to unauthorized code execution, leakage of sensitive environment information and service-integrity compromise.

Component
convex-backend is the core backend service component of the Convex platform, designed to provide real-time data synchronization and function compute for cloud-native applications. Its architecture integrates an MCP server to support automated agent interaction, with core capabilities covering deployment management, environment-variable configuration and code execution, aiming for efficient application lifecycle management and resource scheduling.
Type
Incorrect Authorization (CWE-863)
Repo
github.com/get-convex/convex-backend · Stars 12521
Remediation
  • Developers should refactor deployment-selector parsing so that all selector forms are normalized to the actual deployment type before the security-guard check, ensuring every request that targets production undergoes strict authorization and an explicit confirmation mechanism, eliminating authorization bypass caused by format differences.
CSSA Exclusive Early Warning 9.6 Critical

LiteLLM case-insensitive email fallback overwrites SSO/JWT subject and steals proxy administrator privileges

When the subject identifier in SSO or JWT authentication does not match the database record, the system incorrectly enables a non-strict email fuzzy-matching fallback. An attacker can exploit this defect by presenting an unverified email claim identical to an existing high-privilege account, inducing the system to bind the new malicious subject to the victim's database row and overwrite the original SSO subject identifier. Because the system lacks a second check on subject changes during role inheritance, the attacker can take over the target account's PROXY_ADMIN privileges and illicitly call sensitive management interfaces such as key generation, causing unauthorized access and potential service disruption.

Component
LiteLLM is a large-language-model routing proxy that supports multi-model access. Its core architecture is built on asynchronous Python and aims to unify API interfaces to simplify enterprise AI application integration. The component has a flexible identity-authentication module supporting protocols such as OIDC, SAML and JWT, and is responsible for user identity verification, session management and access-control policy enforcement in distributed environments to ensure security and compliance of data flow.
Type
Improper Authentication (CWE-287)
Repo
github.com/BerriAI/litellm · Stars 58493
Remediation
  • Remove the automated email fuzzy-matching fallback at the code level and enforce strict subject-consistency checks, allowing linking only when the email has been verified and is currently unbound. Also add role-protection for already-bound accounts, forbidding direct inheritance of high-risk administrative privileges stored in the database merely because identity-provider information is missing, thereby blocking privilege-escalation rebinding at the source.

CVE Intelligence 2

CVE-2026-13745 CVSS 10.0 Critical 2026-09-10

Gemini CLI .env overwrite of GEMINI_CLI_HOME leading to arbitrary code execution

In Gemini CLI and its associated GitHub Action, improper input validation (CWE-20) creates a critical security defect. An unauthorized attacker can overwrite the environment variable GEMINI_CLI_HOME via an untrusted local .env file, achieving arbitrary code execution in Gemini CLI. The vulnerability allows an attacker to hijack the execution flow by manipulating environment configuration without obtaining privileges. It affects all users of defective versions of Gemini CLI and the GitHub Action, especially in CI/CD pipelines or local development environments. An attacker only needs to inject a malicious .env file into the target environment to trigger the vulnerability, which may lead to complete server control or sensitive data disclosure.

Component
Gemini CLI is a command-line tool for interacting with Gemini services, and it provides a corresponding GitHub Action for integration into automated workflows.
Risks
  • From ordinary user to administrator: If the victim runs the CLI or Action with administrator privileges, an attacker can obtain the same privileges
  • Complete system control: An attacker can use this vulnerability to execute arbitrary code on the victim system, and depending on user privileges, install programs, view/modify/delete data, or create new accounts with full privileges
  • Environment-configuration hijack: By overwriting the critical environment variable GEMINI_CLI_HOME, an attacker can redirect tool behavior, load malicious modules or execute preset commands
Source
NVD · CVE-2026-13745
Remediation
  • Strictly review and restrict the origin of .env files, loading only trusted environment configuration
  • Enforce least privilege in CI/CD environments and limit the Action's execution-permission scope
CVE-2026-87986 CVSS 10.0 Critical 2026-09-11

Mistral Vibe parser bypasses permission checks for arbitrary code execution leading to remote code execution

In Mistral Vibe, the command-parsing module cannot correctly interpret certain shell constructs and has an improper handling of syntactically invalid structure (CWE-228) security defect. An attacker uses shell constructs the parser does not recognize to bypass command-permission checks; the unparsed portion is excluded from security checks, allowing embedded commands to execute on the user system without approval. Mistral Vibe has a logic defect when handling specific shell constructs; an attacker can trigger it by crafting malicious input, leading to arbitrary code execution. The vulnerability affects all unpatched Mistral Vibe users. An attacker can complete exploitation by sending crafted requests or inducing the user to perform specific operations, thereby executing arbitrary instructions on the target system.

Component
Mistral Vibe is an open-source tool involving command parsing and execution, used to process user input and perform corresponding system operations.
Risks
  • From ordinary user to administrator: If the victim runs Mistral Vibe with administrator privileges, an attacker can obtain the same privileges
  • Complete system control: An attacker can use this vulnerability to execute arbitrary code on the victim system, and depending on user privileges, install programs, view/modify/delete data, or create new accounts with full privileges
  • Remote code execution: An attacker can craft special shell constructs to bypass permission checks and execute unauthorized commands directly on the user system
Source
NVD · CVE-2026-87986
Remediation
  • Monitor anomalous command-execution behavior logs
  • Enforce strict allowlist validation and sanitization of input data
  • Restrict use of shell constructs and avoid directly executing unparsed complex commands

Package Poisoning 2

Package Poisoning npm 2026-09-11

pinochiomathm@2.3.2 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
f3b77b0f2294710bbee5d7ca07d80a15
Package Poisoning PyPI 2026-09-11

lucy-python-script-2030@0.1.1 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
2649b87ce315abc41e643b5f9520eebf
← Back to Intel CenterRSSMonitor these risks automatically with CleanSource SCA →