Microsoft patched a critical vulnerability in its NLWeb AI search tool – but there's no CVE (yet)
Researchers found an unauthenticated path traversal bug in the tool debuted at Microsoft Build in May
Security researchers have discovered a critical flaw in NLWeb, a new tool unveiled by Microsoft just over two months ago, that allows remote users to read sensitive files without authorization.
NLWeb is a so-called agentic AI tool that allows users to search web pages using a generative AI chatbot, which will remember the users’ preferences.
Ramanathan Guha, a technical fellow at Microsoft, demonstrated how this works using the website Serious Eats during Microsoft Build in May 2025.
While searching for recipes for the Hindu festival of Diwali, Guha mentioned to the chatbot that he is vegetarian. According to Guha, this means the website will only recommend vegetarian recipes when he’s searching for inspiration from now on.
So far, so useful, but it seems new and exciting tools open the door to new and exciting vulnerabilities.
The bug was discovered by Aonan Guan and Lei Wang in a security audit of the NLWeb open source repository.
According to Guan, who wrote about his discovery in a Medium post, the flaw “allowed any remote user to read sensitive files, including system configurations (/etc/passwd) and cloud credentials (.env files), using a simple, malformed URL”.
Guan identified a code block using os.path.normpath() that he said “immediately raised a red flag”.
“The function normalizes path separators but does not prevent a user from "climbing" out of the intended directory with ../ sequences. It's a classic path traversal flaw waiting to be exploited,” he noted.
Guan pointed to three separate oversights in the code that he said led to the vulnerability: improper sanitization, an expanded attack surface, and a lack of final path validation.
What’s being done about the NLWeb flaw?
While the flaw was discovered on 28 May and a vulnerability report submitted the same day, Guan has only just made his and Lei’s findings public.
Additionally, while Microsoft Security Response Center committed a patch on 30 June it confirmed to Guan on 1 July that it wouldn’t be issuing a CVE for the issue.
There is no suggestion from Guan that organizations deploying or experimenting with NLWeb should abandon their projects.
Instead he advises they:
- Update their instance immediately “to any version including or after commit 8ffdb0f from the official GitHub repository”
- Implement WAF/reverse proxy rules
- Never bind NLWeb directly to a public IP address, thus avoiding direct public exposure
- Configure monitoring systems to issue high-priority alerts for suspicious HTTP 404 or 400 error responses for URIs that have path traversal patterns
“This case study serves as a critical reminder that as we build new AI-powered systems, we must re-evaluate the impact of classic vulnerabilities, which now have the potential to compromise not just servers, but the ‘brains’ of AI agents themselves,” Guan said.
ITPro contacted Microsoft for comment on the report, but hadn’t received a response at the time of publication.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- NCSC says ‘limited number’ of UK firms affected by SharePoint attack
- SharePoint flaw: Microsoft says hackers deploying ransomware
- Warning issued after SharePoint flaw puts entire corporate networks at risk
-
‘Perfect’ Zero Trust is killing your mid-market productivitySponsored Security theory often collapses under real-world deadlines. It’s time for a more auditable, “human-centric” approach to privileged access management
-
Increased AI use means developers spend more time reviewing code than everNews While AI is improving productivity and efficiency, many developers are caught up in a vicious cycle of code reviews and bug hunting
-
Google says AI is now being used to build zero-days – and we just narrowly avoided a 'mass exploitation event'News Google cyber researchers think they’ve found the first AI-generated zero-day exploit
-
Beware of emails threatening a code of conduct reviewNews A widespread phishing campaign has targeted tens of thousands of employees
-
UK firms left in the dark over what workers are sharing with AINews Security teams can’t keep track of what workers are sharing with AI applications, regardless of whether they’re approved or unauthorized
-
AI is now a ‘standard part of the attacker toolkit’News Cyber attacks are increasing in scale, intensity, and velocity thanks to AI, and it’s forcing defenders to react faster than ever before
-
AI is raising the stakes for cyber professionals – Claude Mythos just took things to another levelNews AI efficiency gains work both ways, and threat actors are already capitalizing on powerful new tools
-
Is your new hire an AI clone? Microsoft says North Korean hackers are using AI to impersonate job seekers and steal company secretsNews The groups are increasingly using face-changing or voice-changing software to make their fake identities more plausible
-
CrowdStrike says AI is officially supercharging cyber attacks: Average breakout times hit just 29 minutes in 2025, 65% faster than in 2024 – and some attacks take just secondsNews Cyber criminals are actively exploiting AI systems and injecting malicious prompts into legitimate generative AI tools
-
Using AI to generate passwords is a terrible idea, experts warnNews Researchers have warned the use of AI-generated passwords puts users and businesses at risk
