Executive brief
ai-scanner is an AI model safety tool used to scan and secure artificial intelligence deployments. A vulnerability in its browser automation component allows an attacker with a standard user account to execute malicious code on the server. This could lead to a complete takeover of the application, theft of sensitive AI model data, or unauthorized access to the internal network.
Technical details
A remote code execution (RCE) vulnerability exists in ai-scanner versions 1.0.0 through 1.4.0 due to improper sanitization of user-controlled inputs (URLs, CSS selectors, and user-agents) before they are interpolated into Node.js scripts. The `BrowserAutomation::PlaywrightService` builds these scripts as Ruby heredoc strings and executes them via `Open3.capture3`. An attacker can provide a crafted URL containing single quotes to break out of the JavaScript string literal and inject arbitrary Node.js commands. While the application attempts to validate URLs using Ruby's `URI.parse`, this check is insufficient as single quotes are valid URI sub-delimiters. The vulnerability is reachable via the `/targets/auto_detect_selectors` endpoint and requires only basic user authentication. The issue is patched in version 1.4.1.
Affected products
- 0din-ai ai-scanner 1.0.0 to 1.4.0
Timeline
- 2026-04-13: patched: Version 1.4.1 released with security hardening.
- 2026-04-16: advisory: Security advisory GHSA-r27j-xxgx-f5vr published.
- 2026-05-08: disclosed: CVE-2026-41512 published to NVD.