EUVD-2026-56240

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...

CVE-2026-67179

Genkit’s Dev UI server (default port 4000) suffers from improper validation of host request headers, enabling DNS rebinding to reach POST /api/runAction from any host on the developer’s network or any site the developer visits. This allows an attacker to execute any registered Genkit action and r...

@blinkk/root-cms (>=2.0.0 <=2.4.7), @cravery/core (=0.0.2) +8 more potentially affected by unknown CVE via @mistralai/mistralai-gcp (=1.7.0)

@mistralai/mistralai-gcp NPM version =1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on @mistralai/mistralai-gcp and may be impacted: - @blinkk/root-cms =2.0.0, =0.9.7, =0.2.11, =0.0.1, =2.1.4, =0.0.694, =0.0.1, =0.8.11, =0.8.14 Source cves: unknow...

@blinkk/root-cms (>=1.2.0 <=2.0.0-rc.1), @genkit-ai/ai (>=0.5.0 <=0.9.0-rc.3) +47 more potentially affected by unknown CVE via @genkit-ai/core (>=0.5.0-rc.0 <=0.9.0)

@genkit-ai/core NPM version =0.5.0-rc.0, =1.2.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.0.0, =1.0.0, =0.0.1, =0.0.6 and more Source cves: unknown CVE Source advisory: SNYK:JS-GENKITAICORE-12671226...

Race Condition

Overview @genkit-ai/core is a Genkit AI framework core libraries. Affected versions of this package are vulnerable to Race Condition via the asynchronous user engagement collection in the appendSpan and collectUserEngagement methods, where calls were not correctly awaited. Improper handling of...

Race Condition

Overview @genkit-ai/firebase is a Genkit AI framework plugin for Firebase including Firestore trace/state store and deployment helpers for Cloud Functions for Firebase. Affected versions of this package are vulnerable to Race Condition via the asynchronous user engagement collection in the...

@oconva/qvikchat (>=1.0.0 <=2.0.0-alpha.4), genkit-intro (=1.0.0) +3 more potentially affected by unknown CVE via @genkit-ai/firebase (=0.5.17)

@genkit-ai/firebase NPM version =0.5.17 is affected by a known vulnerability. The following packages have a transitive dependency on @genkit-ai/firebase and may be impacted: - @oconva/qvikchat =1.0.0, =0.0.1, =1.0.0 Source cves: unknown CVE Source advisory: SNYK:JS-GENKITAIFIREBASE-12671227...