NEWSkillSec — elevating AI Skills security from malware detection to capability auditingSkillSecLearn more →
← Back to Intel Center
SECURITY INTEL · DAILY
RSS

2026-10-21 Daily Security Intelligence

CSSA 2 · CVE 2 · Poison 0

10.0 Critical · Path traversal flaw in SGLang's multimodal input loader leads t…

CSSA Exclusive Early Warning 2

CSSA Exclusive Early Warning 10.0 Critical

Path traversal flaw in SGLang's multimodal input loader leads to arbitrary file read and denial of service

An attacker can abuse unvalidated multimodal request parameters, specifying an absolute local filesystem path or a file:// URI, to directly access any file the server process has permission to read. Because there is no effective filtering of local paths and no size limit, the vulnerability not only bypasses the existing remote-domain allowlist protection but also lets the attacker extract sensitive file contents or exhaust memory by reading large files, resulting in information disclosure and loss of service availability.

Component
SGLang is a high-performance serving engine for efficient large language model inference. Its architecture centers on real-time processing of multimodal data and standardized API interaction. By integrating an OpenAI-compatible chat completions interface, it aims to give developers low-latency, high-throughput generation of text and multimedia content. It is widely deployed in enterprise applications that need to parse complex visual and audio data, optimizing the scheduling of model inference resources and improving the human-computer interaction experience.
Type
External Control of File Name or Path (CWE-73)
Repo
github.com/sgl-project/sglang · Stars 37555
Remediation
  • Apply strict allowlist validation when handling local file paths and refuse to resolve file requests outside the expected directories. Also set a reasonable file size limit to prevent resource exhaustion, and apply consistent security review to all types of media input sources so that local reads stay within a controlled, safe scope, eliminating the path traversal risk.
CSSA Exclusive Early Warning 10.0 Critical

DNS dynamic authorization in OpenSandbox's network isolation component bypasses port restrictions, risking sandbox escape and data leakage

An attacker can exploit a logic flaw between domain allow rules and port-scoped rules in the policy to gain unauthorized access. When a process inside the sandbox resolves a controlled domain, the DNS proxy adds the target IP to a dynamic allowlist and opens all ports by default, so explicit deny rules for specific ports no longer take effect. The attacker can thereby bypass the network block and connect directly to high-risk service ports on restricted hosts, such as unauthenticated databases or compute coordination services, and go on to move laterally, steal sensitive data, or execute malicious payloads, seriously compromising the confidentiality, integrity, and availability of the system.

Component
OpenSandbox is a fine-grained, application-layer security sandbox built on eBPF, designed to provide strong network isolation for cloud-native environments. Its core architecture relies on a user-space proxy working together with a kernel-space filtering engine, dynamically generating nftables rule chains by parsing policy files to finely control inbound and outbound traffic. The component serves multi-tenant isolation scenarios in microservice architectures, ensuring that each application instance runs only within preset network boundaries and thereby keeping business logic secure and resource scheduling orderly.
Type
Incorrect Authorization (CWE-863)
Repo
github.com/opensandbox-group/OpenSandbox · Stars 16014
Remediation
  • Apply a strict least-privilege principle to network policies. When configuring port-based access control, always deploy complementary all-port deny rules at the same time to cover side effects of dynamic resolution. Also upgrade to a version that supports port range expressions to simplify policy management, and strengthen the mechanism that verifies DNS resolution results are consistent with the predefined network isolation policy.

CVE Intelligence 2

CVE-2026-43836 CVSS 10.0 Critical 2026-10-20

Arbitrary command execution via forged packets in an unknown component leads to highest-privilege control

In affected versions, the system does not strictly validate incoming data packets, resulting in a command injection (CWE-77) flaw. An attacker can forge specific packets to bypass security mechanisms and execute arbitrary commands with the highest privileges. The vulnerability lets the attacker take full control of the system, threatening process stability and security. Although a CVSS score is missing, the description states that arbitrary commands can be executed with the highest privileges; combined with a public PoC and its exploited status, it is rated critical. All unpatched deployments are affected. An attacker can trigger the vulnerability by sending malicious packets over the network and control the system remotely without user interaction.

Component
The affected software component processes network packets and carries a command injection risk, allowing attackers to execute system commands by forging packets.
Risks
  • Highest-privilege takeover: An attacker can directly execute arbitrary commands with the highest privileges and take full control of the system
  • Complete system control: An attacker can exploit this vulnerability to execute arbitrary code on the victim system and, depending on user privileges, install programs, view/change/delete data, or create new fully privileged accounts
  • Remote attack without interaction: An attacker only needs to send forged packets to trigger the vulnerability, with no user interaction required, and can control the system remotely
Source
NVD · CVE-2026-43836
Remediation
  • Monitor logs for anomalous command execution behavior
  • Apply strict format and content validation to incoming network packets
  • Block packets from untrusted sources or with anomalous formats
CVE-2026-112380 CVSS 9.9 Critical 2026-10-21

Missing authorization in Kiro Crew's WhatsApp group channel leads to remote code execution

In Kiro Crew versions before 0.7.2, the WhatsApp group channel lacks an authorization mechanism (CWE-862), a serious security flaw. A remote attacker who is a member of a WhatsApp group configured by the operator can, by sending messages to that group, take control of the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew. All Kiro Crew users who have not updated to 0.7.2 are affected. The attacker only needs to be a member of the specific group and send a malicious message to trigger the vulnerability, achieving remote code execution without any additional user interaction.

Component
Kiro Crew is an automation agent platform that supports multi-channel integration, including a channel module for connecting to WhatsApp groups.
Risks
  • Complete system control: An attacker can exploit this vulnerability to execute arbitrary code on the victim system and, depending on user privileges, install programs, view/change/delete data, or create new fully privileged accounts
  • Session hijacking: An attacker can take control of the operator's other agent sessions, leading to malicious tampering with or abuse of business logic
  • Remote attack without interaction: The attacker needs no additional interaction from the target user and can trigger the vulnerability simply through group messages, so the bar for exploitation is low
Source
NVD · CVE-2026-112380
Remediation
  • Immediately upgrade Kiro Crew to 0.7.2 or later to fix this vulnerability
  • Review WhatsApp group member permissions and remove unnecessary members
  • Monitor logs on the Kiro Crew host for anomalous command execution behavior
← Back to Intel CenterRSSMonitor these risks automatically with CleanSource SCA →