CVE-2026-41512: Remote code execution via JavaScript injection in `BrowserAutomation::PlaywrightService`
Published May 8, 2026
·Updated
ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in BrowserAutomation::PlaywrightService. This issue has been patched in version 1.4.1.
Affected Software
2 affected components
ai-scanner>=1.0.0<1.4.1
Mozilla 0din Scanner>=1.0.0<1.4.1
Remediation
Patch Available
Event History
May 8, 2026
CVE Published
via MITRE·01:52 PM
Data Sourced
via MITRE·01:52 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-41512?
CVE-2026-41512 has a high severity rating due to its potential for remote code execution through JavaScript injection.
2
How do I fix CVE-2026-41512?
To fix CVE-2026-41512, upgrade the ai-scanner software to version 1.4.1 or later.
3
What software is affected by CVE-2026-41512?
CVE-2026-41512 affects ai-scanner versions from 1.0.0 up to, but not including, 1.4.1.
4
What type of vulnerability is CVE-2026-41512?
CVE-2026-41512 is a remote code execution vulnerability caused by JavaScript injection.
5
Can CVE-2026-41512 be exploited remotely?
Yes, CVE-2026-41512 can be exploited remotely, allowing attackers to execute arbitrary code.