https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:01:55 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-61732 <p>Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon&#39;s agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.</p> <p>Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon&#39;s agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-61732 https://vulnerability.circl.lu/vuln/ghsa-g5f9-3xfg-p9mf <p><strong>Affected:</strong> PyPI: decepticon-core, PyPI: decepticon, PyPI: decepticon-sdk</p> <p>## Summary</p> <p>Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon&#39;s agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox.</p> <p>The vast majority of open-source and self-deployed model providers do not filter special-token literals. vLLM explicitly declined to fix this issue on 2026-04-21, closing it as &#34;out of scope for the inference layer.&#34; Fix responsibility therefore falls squarely on the Agent application layer. OpenClaw completed an analogous fix on 2026-04-22 via commit `2514746b3261` (~30 lines, sanitizer applied just before tool-output wrapping), demonstrating the feasibility of application-layer mitigation.</p> <p>## Applicability</p> <p>Confirmed vulnerable when Decepticon is configured with a BYOK OpenAI-compatible backend whose tokenizer preserves special-token IDs — vLLM / SGLang / TGI confirmed ups…</p> <p><strong>Affected:</strong> PyPI: decepticon-core, PyPI: decepticon, PyPI: decepticon-sdk</p> <p>## Summary</p> <p>Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon&#39;s agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox.</p> <p>The vast majority of open-source and self-deployed model providers do not filter special-token literals. vLLM explicitly declined to fix this issue on 2026-04-21, closing it as &#34;out of scope for the inference layer.&#34; Fix responsibility therefore falls squarely on the Agent application layer. OpenClaw completed an analogous fix on 2026-04-22 via commit `2514746b3261` (~30 lines, sanitizer applied just before tool-output wrapping), demonstrating the feasibility of application-layer mitigation.</p> <p>## Applicability</p> <p>Confirmed vulnerable when Decepticon is configured with a BYOK OpenAI-compatible backend whose tokenizer preserves special-token IDs — vLLM / SGLang / TGI confirmed ups…</p> https://vulnerability.circl.lu/vuln/ghsa-g5f9-3xfg-p9mf https://vulnerability.circl.lu/vuln/pysec-2026-4032 <p><strong>Affected:</strong> PyPI: decepticon</p> <p>## Summary</p> <p>Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon&#39;s agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox.</p> <p>The vast majority of open-source and self-deployed model providers do not filter special-token literals. vLLM explicitly declined to fix this issue on 2026-04-21, closing it as &#34;out of scope for the inference layer.&#34; Fix responsibility therefore falls squarely on the Agent application layer. OpenClaw completed an analogous fix on 2026-04-22 via commit `2514746b3261` (~30 lines, sanitizer applied just before tool-output wrapping), demonstrating the feasibility of application-layer mitigation.</p> <p>## Applicability</p> <p>Confirmed vulnerable when Decepticon is configured with a BYOK OpenAI-compatible backend whose tokenizer preserves special-token IDs — vLLM / SGLang / TGI confirmed ups…</p> <p><strong>Affected:</strong> PyPI: decepticon</p> <p>## Summary</p> <p>Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon&#39;s agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox.</p> <p>The vast majority of open-source and self-deployed model providers do not filter special-token literals. vLLM explicitly declined to fix this issue on 2026-04-21, closing it as &#34;out of scope for the inference layer.&#34; Fix responsibility therefore falls squarely on the Agent application layer. OpenClaw completed an analogous fix on 2026-04-22 via commit `2514746b3261` (~30 lines, sanitizer applied just before tool-output wrapping), demonstrating the feasibility of application-layer mitigation.</p> <p>## Applicability</p> <p>Confirmed vulnerable when Decepticon is configured with a BYOK OpenAI-compatible backend whose tokenizer preserves special-token IDs — vLLM / SGLang / TGI confirmed ups…</p> https://vulnerability.circl.lu/vuln/pysec-2026-4032