OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hidden system prompt by…
OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hidden system prompt by submitting crafted chat input to POST /api/v1/rca/chat. Attackers can instruct the assistant to ignore its rules and reveal internal orchestration instructions, aiding the crafting of further prompt injection attacks.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- OpsTree Solutions
- Product
- REMS
- CVSS v3.1
- 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- NVD status
- Received
Why it ranks 9 (Routine)
- CVSS v3.1 4.3 medium
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.