CVE-2026-61732Decepticon Vulnerability
Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals.
Published Sep 24, 2026 · Updated Oct 2, 2026 · Also known as EUVD-2026-86329, GHSA-g5f9-3xfg-p9mf, PYSEC-2026-4032, PYSEC-2026-4033, PYSEC-2026-4034
Key Facts
Patch immediately- CVE-2026-61732 is a critical-severity vulnerability (CVSS 10.0 v3.1) affecting Decepticon (pypi), decepticon-core (pypi), decepticon-sdk (pypi).
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 1.2% probability of exploitation in the next 30 days.
- Fixed versions are available, including Decepticon 1.1.17, decepticon-core 1.1.17, decepticon-sdk 1.1.17.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
10.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
1.2%
Higher than 68.2% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
44/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
2
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint.
Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.
Affected Products
9 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Decepticonpypi | >= < 1.1.17 | 1.1.17 |
| decepticon-corepypi | >= < 1.1.17 | 1.1.17 |
| decepticon-sdkpypi | >= < 1.1.17 | 1.1.17 |
Patched Releases
Decepticon
1.1.17
decepticon-core
1.1.17
decepticon-sdk
1.1.17
Timeline
Publicly disclosed
Sep 24, 2026
Last updated
Oct 2, 2026
Weakness Type
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
References
- advisorycve.org · CVERecord
- advisorynvd.nist.gov · CVE-2026-61732
- advisoryGHSA advisory
- articlegithub.com · 715
- articlegithub.com · v1.1.17
FAQ
Common Questions.
Decepticon is an autonomous hacking agent for red teams.
Affected: Decepticon (pypi) versions >= < 1.1.17; decepticon-core (pypi) versions >= < 1.1.17; decepticon-sdk (pypi) versions >= < 1.1.17. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including Decepticon 1.1.17, decepticon-core 1.1.17, decepticon-sdk 1.1.17.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-61732 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo