ai-scanner: JavaScript injection in the Playwright browser-automation service gives remote code execution

CVSS 9.9CVE-2026-41512AI/ML frameworks & servingcurated

Impact

ai-scanner is a model-safety scanner built on NVIDIA garak; versions 1.0.0 through 1.4.0 allow remote code execution through JavaScript injection in its Playwright browser-automation service. Where this is wired into a model-evaluation or red-teaming pipeline it runs with whatever credentials that pipeline holds - model endpoints, API keys, registry access - so code execution there reaches the evaluation harness rather than a developer laptop. The CVSS vector has a changed scope with high impact across the board and needs only low privilege, consistent with escaping the scanner's own context. The published record is thin: it names the sink and the fixed version and nothing more, so the precise injection path is not documented here.

Who can reach it

Network, authenticated at low privilege (AV:N/PR:L), against an ai-scanner instance whose Playwright automation processes attacker-influenced content. Anyone who can feed the scanner a scan target or payload is in position.

What to do

Upgrade ai-scanner to 1.4.1, which carries the patch, and restart whatever service or job runner hosts it. No mitigation or workaround for earlier versions is given in the advisory. If the scanner runs as a long-lived service, this is a package upgrade plus a daemon restart; if it only runs as a CI job, pin the new version in the job image.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-41512 https://github.com/0din-ai/ai-scanner/releases/tag/v1.4.1 https://github.com/0din-ai/ai-scanner/security/advisories/GHSA-r27j-xxgx-f5vr

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.