CVE-2026-41512

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in `BrowserAutomation::PlaywrightService`. This issue has been patched in version 1.4.1.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: May 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-415134.8Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirect users to arbitrary CVE-2026-415143.3OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the CVE-2026-415153.3OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the CVE-2026-415163.3OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the CVE-2026-415170.0Emlog is an open source website building system. Prior to version 2.6.11, insecure plugin upload functionality allows attackers to upload an CVE-2026-415187.6Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In versions 4 CVE-2026-415195.4Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invali CVE-2026-41527.8GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute CVE-2026-415204.4Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, th CVE-2026-415219.1xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update message CVE-2026-415227.1Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, CVE-2026-415237.5vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activati