CVE-2026-41512 Overview
CVE-2026-41512 is a remote code execution vulnerability in ai-scanner, an AI model safety scanner built on NVIDIA garak. The flaw affects versions 1.0.0 through versions prior to 1.4.1 and resides in the BrowserAutomation::PlaywrightService component. Attackers can achieve code execution through JavaScript injection against the Playwright-driven browser automation layer. The issue is categorized under CWE-94 (Improper Control of Generation of Code). The vendor has patched the issue in version 1.4.1.
Critical Impact
Authenticated attackers can execute arbitrary code on systems running vulnerable ai-scanner versions through JavaScript injection in the Playwright browser automation service, leading to full host compromise.
Affected Products
- ai-scanner versions 1.0.0 through versions earlier than 1.4.1
- Mozilla 0din Scanner (component mozilla:0din_scanner)
- Deployments using BrowserAutomation::PlaywrightService
Discovery Timeline
- 2026-05-08 - CVE-2026-41512 published to NVD
- 2026-05-11 - Last updated in NVD database
Technical Details for CVE-2026-41512
Vulnerability Analysis
The vulnerability resides in the BrowserAutomation::PlaywrightService module of ai-scanner, a tool designed to evaluate AI model safety using NVIDIA garak. Playwright is a Node.js library used to automate Chromium, Firefox, and WebKit browsers. The service evaluates or processes attacker-controlled input within the browser automation context without sufficient sanitization. As a result, injected JavaScript escapes its intended scope and triggers code execution on the host running the scanner.
The issue carries the CWE-94 classification for improper control over code generation. The EPSS score is 0.321% at the 55th percentile as of 2026-05-18, indicating low observed exploitation activity at publication.
Root Cause
The root cause is unsafe handling of input that flows into Playwright JavaScript evaluation primitives such as page.evaluate, page.evaluateHandle, or string-based selector and script arguments. When attacker-controlled content is concatenated into a script body rather than passed as a serialized argument, the Playwright runtime executes the resulting code inside the browser context, where it can pivot to host-side automation logic.
Attack Vector
The attack vector is network-based and requires low privileges with no user interaction. An attacker who can submit content processed by PlaywrightService (for example, a target URL, prompt, or scan payload reflected into browser automation) supplies JavaScript that the service evaluates. Because ai-scanner is intended to probe AI systems, attacker-controlled responses from a tested model or target endpoint can become the injection source. Successful exploitation leads to arbitrary code execution with the privileges of the scanner process.
No public proof-of-concept exploit is referenced in the advisory. Refer to the GitHub Security Advisory GHSA-r27j-xxgx-f5vr for technical details.
Detection Methods for CVE-2026-41512
Indicators of Compromise
- Unexpected child processes spawned by Node.js or Playwright browser binaries (chromium, firefox, webkit) on scanner hosts.
- Outbound network connections from scanner hosts to unknown infrastructure following scan jobs.
- Anomalous file writes under the ai-scanner working directory or temporary directories used by Playwright.
Detection Strategies
- Inventory all hosts running ai-scanner and verify the installed version is 1.4.1 or later.
- Audit scan logs for inputs containing JavaScript syntax such as <script>, javascript:, or template-literal escapes routed to PlaywrightService.
- Correlate Playwright execution events with subsequent process creation on the host to identify code execution chains.
Monitoring Recommendations
- Enable process-creation and command-line auditing on all hosts running ai-scanner.
- Monitor egress traffic from scanner workloads and alert on connections to non-allowlisted destinations.
- Track integrity of the ai-scanner installation directory and Node.js dependency tree for unexpected modifications.
How to Mitigate CVE-2026-41512
Immediate Actions Required
- Upgrade ai-scanner to version 1.4.1 or later as published in the v1.4.1 release notes.
- Restrict access to the ai-scanner API and management interfaces to trusted operators only.
- Run ai-scanner in an isolated, ephemeral environment such as a dedicated container or VM to limit blast radius.
Patch Information
The vendor released version 1.4.1 of ai-scanner, which remediates the JavaScript injection flaw in BrowserAutomation::PlaywrightService. Patch details are available in the GitHub Security Advisory GHSA-r27j-xxgx-f5vr and the ai-scanner v1.4.1 release.
Workarounds
- If patching is not immediately possible, disable or remove the BrowserAutomation::PlaywrightService functionality from the scanner workflow.
- Place ai-scanner instances behind network segmentation that blocks outbound traffic except to required scan targets.
- Run the scanner under a dedicated, low-privilege service account with no access to sensitive credentials or secrets stores.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
