CVE Intelligence
Analysis AI-assisted

CVE-2026-41512: ai-scanner RCE via JavaScript injection in BrowserAutomation::PlaywrightService

A critical remote code execution flaw in the BrowserAutomation::PlaywrightService component of ai-scanner is caused by JavaScript injection (CWE-94). Versions from 1.0.0 up to before 1.4.1 are affected, and the issue is fixed in 1.4.1. No confirmed active exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

ai-scanner is an AI model safety scanner built on NVIDIA garak. The record describes a remote code execution issue caused by JavaScript injection in the BrowserAutomation::PlaywrightService component, classified as CWE-94 Code Injection.

Impact

  • GitHub reports a CVSS score of 9.9 (critical).
  • The vector indicates network reachability, low privileges required, no user interaction, a scope change, and high confidentiality, integrity and availability impact.
  • Successful exploitation would likely allow arbitrary code execution in the context of the affected service.

Affected products and versions

  • 0din-ai ai-scanner: from 1.0.0 up to before 1.4.1.
  • Mozilla 0din Scanner: from 1.0.0 up to before 1.4.1.

Exploitation status

  • This CVE is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted.
  • The SSVC data in the record lists exploitation as proof of concept (poc), and one reference is tagged as Exploit. These details do not confirm exploitation in the wild.

Remediation and mitigation

  • Upgrade ai-scanner to version 1.4.1, the patched release named in the record.
  • Inventory deployments of the 0din-ai ai-scanner and Mozilla 0din Scanner packages and prioritize those within the affected range.
  • Until patching is complete, limit network exposure of the scanner and restrict who can submit inputs that reach the browser automation component.

Detection guidance

  • Review application and host logs for unexpected browser automation activity or unusual script content handled by the scanner.
  • Monitor the scanner host for unexpected child processes or outbound connections.

Limitations of the available information

  • The record does not describe the exact injection vector, required inputs or affected code paths.
  • The record does not state whether workarounds other than upgrading exist.
  • The EPSS values are reported as recorded, including their date.

Frequently asked questions

Which versions of ai-scanner are affected by CVE-2026-41512?

The record lists versions from 1.0.0 up to before 1.4.1 as affected.

Is there a fix for this vulnerability?

Yes. The record names version 1.4.1 as the patched release, and the linked release page is the official reference for it.

Is this vulnerability known to be exploited in the wild?

It is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record shows a proof-of-concept exploitation status in SSVC data.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.