Remote Code Execution Vulnerability in Cocos AI by Ultravioletrs

CVE-2026-119344

What is CVE-2026-119344?

Cocos AI, a confidential computing system for AI, contains a significant vulnerability in versions 0.8.2 and earlier. The system improperly handles trusted execution environment attestation Evidence, failing to bind it to an authorized platform owner or unique machine identity, and does not enforce revocation protocols. This allows a remote attacker controlling or compromising a different platform trusted by the same verifier to replace valid Evidence, potentially authorizing an unauthorized platform. This issue is not addressable solely through source code patches, as it originates from the broader confidential computing threat model. The vulnerability is resolved in version 0.9.0.

References