Remote Code Execution in AI Scanner by NVIDIA Garak
CVE-2026-41512

9.9CRITICAL

Key Information:

Vendor

0din-ai

Status
Ai-scanner
Vendor
CVE Published:
8 May 2026

What is CVE-2026-41512?

The ai-scanner, developed on NVIDIA garak, is vulnerable to a remote code execution exploit due to JavaScript injection in the BrowserAutomation::PlaywrightService component. This issue affects versions from 1.0.0 to below 1.4.1, allowing attackers to execute arbitrary code remotely. A patch has been implemented in version 1.4.1 to resolve this vulnerability.

Affected Version(s)

ai-scanner >= 1.0.0, < 1.4.1

References

https://github.com/0din-ai/ai-scanner/security/advisories...
x_refsource_CONFIRM
https://github.com/0din-ai/ai-scanner/releases/tag/v1.4.1
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.