Independent security research on AI/LLM infrastructure — focusing on multi-tenant isolation, MCP protocol attack surface, and SSRF/cookie boundary leakage in widely-deployed LLM platforms.
10 fixes shipped across 5 major projects with a combined 335,000+ GitHub stars, including 5 GHSA advisory IDs (1 published, 4 reserved pending coordinated-disclosure window). 3 additional fixes currently in review (Dify, Microsoft autogen, crewAI).
| GHSA | Project | Class | Fix PR | Status |
|---|---|---|---|---|
| GHSA-2qwc-c2cc-2xwv | Dify | Tenant boundary violation | dify#35797 | reserved |
| GHSA-gvc6-fh3x-89xh | Dify | Path traversal | dify#35796 | reserved |
| GHSA-48xc-wmw8-3jr3 | Dify | Tenant boundary violation | dify#35793 | reserved |
| GHSA-2mr9-9r47-px2g | Gradio | Cross-Space cookie injection | gradio#13384 | reserved |
| GHSA-jmh7-g254-2cq9 | Gradio | SSRF (regression coverage) | gradio#13388 | published |
Dify — 143k⭐
LLM application platform. Focus: tenant-scoping holes, plugin-daemon path traversal, key-rotation completeness.
| PR | Class | Description |
|---|---|---|
| #35843 | Key-rotation completeness | reset-encrypt-key-pair left stale ciphertext in tool_builtin_providers / tool_api_providers / tool_mcp_providers — extended purge + regression tests |
| #35797 | Tenant boundary | FilePreviewApi text-extract endpoint accepted arbitrary tenant scope (GHSA-2qwc-c2cc-2xwv, reserved) |
| #35796 | Path traversal | Plugin-daemon file paths accepted ../ sequences (GHSA-gvc6-fh3x-89xh, reserved) |
| #35793 | Tenant boundary | App trace-config endpoints were not tenant-scoped (GHSA-48xc-wmw8-3jr3, reserved) |
| #34456 | IDOR | Data source binding missed tenant_id validation, enabling cross-tenant resource access |
| #36197 (in review) | SSRF | MCP server_url accepted internal addresses (127.0.0.1, link-local, RFC1918) |
Cherry Studio — 46k⭐
Multi-provider LLM desktop client. Focus: MCP protocol attack surface in an Electron host.
| PR | Class | Description |
|---|---|---|
| #13893 | XSS | dangerouslySetInnerHTML rendered untrusted MCP server descriptions and search results unsanitized |
| #13892 | URL validation + path traversal | shell.openExternal accepted file:// and arbitrary schemes; companion path-traversal guard |
| #14083 | Credential hygiene | OAuth tokens for deleted MCP servers persisted in disk-backed store |
Gradio — 42k⭐
ML demo / Spaces framework. Focus: cross-origin isolation and SSRF in the proxy layer.
| PR | Class | Description |
|---|---|---|
| #13384 | Cross-origin cookies | /proxy= shared a single cookie jar across Hugging Face Spaces, enabling cookie injection across tenants (GHSA-2mr9-9r47-px2g, reserved) |
| #13388 | SSRF regression test | Regression coverage for Blocks.from_config proxy_url SSRF guard (GHSA-jmh7-g254-2cq9) |
autogen — 58k⭐ (in review)
Microsoft agent-orchestration framework.
| PR | Class | Description |
|---|---|---|
| #7611 | Code execution sandbox | Opt-in sandbox flag for LocalCommandLineCodeExecutor (addresses #7462) |
crewAI — 52k⭐ (in review)
Multi-agent framework.
| PR | Class | Description |
|---|---|---|
| #5307 | Code injection | Replaced eval() in the calculator tool template with an AST-based safe evaluator |
- Multi-tenant isolation in LLM platforms — IDOR, tenant-scoping gaps, cross-tenant resource enumeration (Dify boundary work)
- MCP protocol attack surface — SSRF on
server_url, untrusted server-supplied content rendered in clients, OAuth credential lifecycle (Dify + Cherry Studio + autogen) - Cross-origin cookie & session isolation — shared jars, proxy boundary leakage (Gradio)
- Code execution boundaries in agent frameworks —
eval()removal, sandbox affordances (crewAI + autogen)
- Coordinated disclosure via GitHub Security Advisories where applicable (5 GHSA IDs assigned across the 10 shipped fixes; 1 currently published, 4 reserved during the upstream disclosure window). Remaining fixes shipped as direct upstream
fix(security):PRs or correctness-adjacent hardening. - Every fix ships with regression tests in the same PR
- Root cause + impact + repro included in each PR description
Maintained by @xr843. Also building fojin (佛津) — open-source Buddhist digital humanities platform.