GuardReasoner-VL

GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoning Yue Liu, Shengfang Zhai, Mingzhe Du Yulin Chen, Tri Cao, Hongcheng Gao, Cheng Wang Xinfeng Li, Kun Wang, Junfeng Fang, Jiaheng Zhang, Bryan Hooi 1National University of Singapore, 2Nanyang Technological University To enhance the safety ...

EUVD-2026-98918

unstructured: Stored XSS via unescaped HTML generation...

CVE-2026-104250

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

CVE-2026-104250

The unstructured library is vulnerable to Stored XSS prior to version 0.24.1 . The root cause is that the to_html() path in unstructured/documents/ontology.py fails to escape output or reject unsafe URL schemes when using partition_html(html_parser_version="v2") or the VLM partitioner . This allo...

CVE-2026-104250

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

CVE-2026-104250: Improper Neutralization of Input During Web Page Generation

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

PT-2026-111681

Name of the Vulnerable Software and Affected Versions unstructured versions prior to 0.24.1 Description The library fails to properly escape output or reject unsafe URL schemes in the to html path within unstructured/documents/ontology.py. This allows untrusted document tags, attributes, text, an...

Unstructured output processing vulnerability

Versions of Unstructured prior to 0.24.1 contain security vulnerabilities. These vulnerabilities stem from the fact that the partitionhtml and VLM partitioner retain untrusted document tags, attributes, texts, and link targets in metadata.textashtml. Additionally, the tohtml function in...

Black-Box Adversarial Patch Attacks on VLAs Via Ancestor VLM Exploitation

Vision-Language-Action models VLAs are increasingly deployed in safety-critical physical environments, yet their adversarial robustness remains poorly understood. Existing attacks typically assume white-box access or rely on surrogate VLAs, which rarely holds in real-world deployments. Our key...

langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs

Summary langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model VLM requests. If an application passed attacker-controlled image input to ChatNVIDIA or VLM reranking APIs, an attacker could cause files readable by the applicati...

GHSA-G28H-2CMM-RJ9X langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs

Summary langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model VLM requests. If an application passed attacker-controlled image input to ChatNVIDIA or VLM reranking APIs, an attacker could cause files readable by the applicati...

PT-2026-105510

Summary langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model VLM requests. If an application passed attacker-controlled image input to ChatNVIDIA or VLM reranking APIs, an attacker could cause files readable by the applicati...

AgentHijack: Visual Patch Attacks on Multimodal Computer-Use Agents

This paper presents an end-to-end evaluation framework for image-triggered command injection against computer-use agents CUAs. The goal is to test whether a local visual patch can induce verifiable environmental consequences along the full chain of screenshot input, VLM generation, action parsing...

CAPTCHAs in the Agentic Era: Solvers That Learn from Every Encounter

Vision-language models VLMs can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch. For such an agent, the hundredth instance of a familiar puzzle costs as much time and compute as the first. Specialized detectors invert the...

Once Poisoned, Arbitrarily Controlled: A Programmable Backdoor in VLMs

Existing vision-language model VLM backdoors are usually treated as static vulnerabilities: one-to-one and N-to-N attacks bind one or more triggers to a finite set of targets before victim training. This assumption substantially underestimates the threat. We show that a single poisoning phase can...

PYSEC-2026-1965 Hugging Face Text Generation Inference vulnerable to Uncontrolled Resource Consumption

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching during input validation in VLM mode. The issue arises when the router scans inputs for Markdown image links and performs a blocking HTTP GET...

infervcpy (>=0.1.0, <=1.6.0), lisa-on-cuda (1.4.1) +3 more potentially affected by CVE-2024-12217 via gradio (4.40.0)

gradio PYPI version 4.40.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - infervcpy =0.1.0, =0.0.12, =1.0.0a30, =1.0.0, =1.0.1 Source cves: CVE-2024-12217 Source advisory: OSV:PYSEC-2026-1418...

infervcpy (>=0.1.0, <=1.6.0), lisa-on-cuda (1.4.1) +3 more potentially affected by CVE-2026-10783 via gradio (4.40.0)

gradio PYPI version 4.40.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - infervcpy =0.1.0, =0.0.12, =1.0.0a30, =1.0.0, =1.0.1 Source cves: CVE-2026-10783 Source advisory: OSV:PYSEC-2026-211...

infervcpy (>=0.1.0, <=1.6.0), lisa-on-cuda (1.4.1) +3 more potentially affected by CVE-2026-28416 via gradio (4.40.0)

gradio PYPI version 4.40.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - infervcpy =0.1.0, =0.0.12, =1.0.0a30, =1.0.0, =1.0.1 Source cves: CVE-2026-28416 Source advisory: OSV:GHSA-JMH7-G254-2CQ9...

infervcpy (>=0.1.0, <=1.6.0), lisa-on-cuda (1.4.1) +3 more potentially affected by CVE-2026-28415 via gradio (4.40.0)

gradio PYPI version 4.40.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - infervcpy =0.1.0, =0.0.12, =1.0.0a30, =1.0.0, =1.0.1 Source cves: CVE-2026-28415 Source advisory: OSV:GHSA-PFJF-5GXR-995X...