CVE-2026-61732 Details
Description
Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.
A vulnerability in Decepticon, an autonomous hacking agent for red teams, allows for arbitrary command execution under specific conditions. This issue affects versions of Decepticon prior to 1.1.17. The vulnerability arises because the application wraps web crawl results into messages for large language models (LLMs) without properly neutralizing special-token literals used in ChatML, a format compatible with OpenAI's API. When deployed in a 'Bring Your Own Key' (BYOK) model with certain self-hosted or open-source LLM providers, these unfiltered literals can be parsed into structural tokens that forge authoritative commands, bypassing Decepticon's safeguards and executing arbitrary commands within a Kali Linux sandbox.
Users can update to Decepticon version 1.1.17, which includes a patch that neutralizes ChatML special-token literals in untrusted tool output. Instructions for updating can be found in the Decepticon GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/BitterSecurity/Decepticon/security/advisories/GHSA-g5f9-3xfg-p9mf | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/BitterSecurity/Decepticon/commit/79ee2aaf22f4c36a5b1968f6ca3f8086b6e35b67 | [email protected] | Source CodeVendor |
| https://github.com/BitterSecurity/Decepticon/security/advisories/GHSA-g5f9-3xfg-p9mf | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PurpleAILAB/Decepticon | <= 1.1.16 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |