CVE-2026-61732 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-61732 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-61732 is a critical prompt-injection-to-RCE flaw in Decepticon’s LLM message pipeline. When Decepticon ingests untrusted web content through its recon tools and forwards that content into a BYOK OpenAI-compatible model backend, ChatML special-token literals such as <|im_start|> can be interpreted as real role boundaries. An attacker can plant a malicious string in a target page, forge a new “system” or “assistant” turn, and coerce the agent into running attacker-chosen shell commands inside the Kali sandbox.

This is not currently known to be exploited in the wild and is not in CISA KEV, but the severity is CRITICAL (CVSS 10). The issue affects the Decepticon agent stack broadly because all specialist agents share the same LLM context pipeline.

Immediate Action

  • Treat all web-crawl and tool output as hostile. Stop or isolate Decepticon jobs that process untrusted pages until a fix is deployed.
  • Disable BYOK backends that preserve special-token literals if you cannot patch immediately. Prefer hosted vendors that strip these literals server-side.
  • Patch or roll back to a version with literal filtering/escaping applied before any tool output is wrapped into LLM messages.
  • Restrict sandbox command execution and network access as a temporary containment measure.
  • Review vendor guidance and watch for a Decepticon advisory or release note with a fixed build. Vendor advisory

Affected Versions

  • pip decepticon-core vulnerable in v1.1.4 and likely adjacent releases; upgrade to a release that includes special-token sanitization (TOD0_FIXED_VERSION+).
  • pip decepticon vulnerable in v1.1.4; upgrade to TOD0_FIXED_VERSION+.
  • pip decepticon-sdk vulnerable in v1.1.4; upgrade to TOD0_FIXED_VERSION+.
  • Most exposed when configured with BYOK OpenAI-compatible backends that preserve special-token IDs, including vLLM, SGLang, and TGI.
  • Hosted vendors that strip these literals server-side are less exposed, but that is not a durable fix.

Resolution Guide

Python / pip

python -m pip install --upgrade decepticon-core decepticon decepticon-sdk
# If a fixed release is published, pin it explicitly:
python -m pip install "decepticon-core>=TODO_FIXED_VERSION" "decepticon>=TODO_FIXED_VERSION" "decepticon-sdk>=TODO_FIXED_VERSION"

pipx

pipx upgrade decepticon
# or reinstall from a fixed version
pipx install "decepticon==TODO_FIXED_VERSION"

Docker

docker pull purpleailab/decepticon:TODO_FIXED_TAG
docker compose down
docker compose up -d

Hardening: block special-token literals before message composition

def sanitize_untrusted(text: str) -> str:
    tokens = [
        "<|im_start|>", "<|im_end|>", "<|endoftext|>",
        "<|begin_of_text|>", "<|end_of_text|>",
        "<|start_header_id|>", "<|end_header_id|>", "<|eot_id|>",
        "<start_of_turn>", "<end_of_turn>",
        "[INST]", "[/INST]", "<<SYS>>", "<</SYS>>",
    ]
    for t in tokens:
        text = text.replace(t, f"[blocked:{t}]")
    return text

Minimal application-layer patch example

# Before wrapping tool output into a ToolMessage:
safe_output = sanitize_untrusted(raw_tool_output)
messages.append({"role": "tool", "content": safe_output})

Operational workaround

# Reduce blast radius while patching
# 1) Run the sandbox with no outbound network
# 2) Disable arbitrary shell tools if possible
# 3) Limit target scope to trusted/internal pages only
# 4) Restart containers after patching

Detection & Verification

Check installed versions

python -m pip show decepticon-core decepticon decepticon-sdk

Search for unsafe message composition

grep -RIn "ToolMessage\|ainvoke\|apply_chat_template\|raw tool output" .
grep -RIn "<|im_start|>\|<|im_end|>\|<start_of_turn>\|\\[INST\\]" .

Verify the fix

# Confirm the sanitizer is present in the code path
grep -RIn "sanitize_untrusted\|blocked:" .

# Re-run a test payload containing ChatML literals and ensure they are escaped, not interpreted
python -m pytest -q tests/test_sanitization.py

Behavioral check: after patching, a payload containing <|im_start|>system should remain plain text in the tool message and must not create a new role turn or trigger sandbox command execution.

Risk and Impact

An attacker can turn a harmless-looking web page into a command-injection payload for the agent. In the worst case, Decepticon will execute attacker-supplied shell commands inside its Kali sandbox, enabling data theft, environment tampering, lateral movement, or destructive actions depending on how the sandbox is connected.

The blast radius is broad because the vulnerable pipeline is shared across all specialist agents and all untrusted external content paths. If your deployment uses BYOK with a tokenizer that preserves special-token literals, assume the issue is reachable until you add application-layer filtering or escaping.

Keep reading