Description
Uncontrolled search path for some AI Playground software before version 3.0.0 alpha within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Published: 2026-05-12
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an uncontrolled search path flaw (CWE‑427) that allows a user with local access to an AI Playground instance to cause the application to load binaries from unintended locations. Because the flaw can be triggered by an authenticated user and requires high attack complexity, it can lead to execution of arbitrary code with elevated privileges. This results in loss of confidentiality, integrity, and availability for the system as a whole.

Affected Systems

The flaw affects AI Playground software prior to version 3.0.0 alpha. No other vendors or product variants are listed as affected.

Risk and Exploitability

The CVSS score is 5.4, indicating a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The impact can be realized through local access when the attacker has an authenticated session and can interact with the user. The required knowledge is minimal, so the likelihood of exploitation depends largely on user interaction.

Generated by OpenCVE AI on May 12, 2026 at 17:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade AI Playground to version 3.0.0 alpha or later, which removes the uncontrolled search path by sanitizing environment variables before executing binaries.
  • If upgrading is not immediately possible, configure the application to run with a restricted PATH that excludes system directories or directories containing potentially malicious executables.
  • Implement file integrity monitoring to detect unauthorized modifications to the search path configuration or executable locations in the AI Playground environment.

Generated by OpenCVE AI on May 12, 2026 at 17:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 12 May 2026 18:15:00 +0000

Type Values Removed Values Added
Title Uncontrolled Search Path Enabling Privilege Escalation in AI Playground

Tue, 12 May 2026 16:45:00 +0000

Type Values Removed Values Added
Description Uncontrolled search path for some AI Playground software before version 3.0.0 alpha within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Weaknesses CWE-427
References
Metrics cvssV4_0

{'score': 5.4, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: intel

Published:

Updated: 2026-05-12T17:06:04.917Z

Reserved: 2025-04-15T21:26:10.366Z

Link: CVE-2025-36515

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-12T17:16:14.993

Modified: 2026-05-12T17:16:14.993

Link: CVE-2025-36515

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-12T18:00:12Z

Weaknesses