PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2024-9143] DOMPurify bypasses, prompt injecting ChatGPT to shell, AI fuzz finds – ethical hacker news roundup

yeswehack.com | blog | CVE-2024-9143 | #ai-security | #prompt-injection | #llm-security | #openssl | #oss-fuzz | #dompurify | #roundup
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Roundup: DOMPurify bypasses in default configs through v3.1.2, prompt injection to shell in OpenAI's containerised ChatGPT, and AI-enhanced OSS-Fuzz finding 26 flaws incl. OpenSSL CVE-2024-9143.
CVE
CVE-2024-9143
Published
Collected

Related coverage

blog · blog.sentry.security
ChatML Role Injection (CRI)
Attackers can inject system roles into ChatML message arrays to override developer instructions, invoke hidden tools, and pad payloads for denial-of-wallet DoS; strict schema validation is key.
blog · wiz.io
Introducing the Prompt Airlines CTF: Test Your AI Security Skills
Wiz launched Prompt Airlines, a chatbot-based CTF where players exploit AI logic flaws to win a free flight ticket, teaching real LLM security risks; open to all skill levels.
research · wiz.io
Inside 90 days of attacks on AI infrastructure
This research provides real-world threat telemetry on how attackers target modern AI deployments and MCP interfaces.
tool · github.com
LLM SecRange: Open-Source Penetration Testing Playground for Large Language Models & Vulnerable Agents
Offers security researchers and penetration testers an out-of-the-box, comprehensive environment to practice prompt injection, OWASP LLM Top 10 risks, and agent tool-abuse exploitation against real models.
vulnerability · netspi.com
Exploiting a Generative AI Chatbot – Prompt Injection to Remote Code Execution (RCE)
NetSPI built a deliberately vulnerable LLM chatbot to demonstrate prompt injection risks. The walkthrough shows how injected prompts enable data disclosure and, with code execution features, RCE.
blog · yeswehack.com
Testing AI-powered systems at scale via Bug Bounty, part 3: the guardrails
AI guardrail failures often do not fit conventional CVSS-based triage. The program-design guidance helps teams define scope, reproducibility, impact and rewards for model-behavior and misuse-resistance testing.
Back