Security researchers have discovered a critical flaw in NLWeb, a new tool unveiled by Microsoft just over two months ago, that allows remote users to read sensitive files without authorization.
NLWeb is a so-called agentic AI tool that allows users to search web pages using a generative AI chatbot, which will remember the users’ preferences.
Ramanathan Guha, a technical fellow at Microsoft, demonstrated how this works using the website Serious Eats during Microsoft Build in May 2025.
While searching for recipes for the Hindu festival of Diwali, Guha mentioned to the chatbot that he is vegetarian. According to Guha, this means the website will only recommend vegetarian recipes when he’s searching for inspiration from now on.
So far, so useful, but it seems new and exciting tools open the door to new and exciting vulnerabilities.
The bug was discovered by Aonan Guan and Lei Wang in a security audit of the NLWeb open source repository.
According to Guan, who wrote about his discovery in a Medium post, the flaw “allowed any remote user to read sensitive files, including system configurations (/etc/passwd) and cloud credentials (.env files), using a simple, malformed URL”.
Guan identified a code block using os.path.normpath() that he said “immediately raised a red flag”.
“The function normalizes path separators but does not prevent a user from "climbing" out of the intended directory with ../ sequences. It's a classic path traversal flaw waiting to be exploited,” he noted.
Guan pointed to three separate oversights in the code that he said led to the vulnerability: improper sanitization, an expanded attack surface, and a lack of final path validation.
What’s being done about the NLWeb flaw?
While the flaw was discovered on 28 May and a vulnerability report submitted the same day, Guan has only just made his and Lei’s findings public.
Additionally, while Microsoft Security Response Center committed a patch on 30 June it confirmed to Guan on 1 July that it wouldn’t be issuing a CVE for the issue.
There is no suggestion from Guan that organizations deploying or experimenting with NLWeb should abandon their projects.
Instead he advises they:
- Update their instance immediately “to any version including or after commit 8ffdb0f from the official GitHub repository”
- Implement WAF/reverse proxy rules
- Never bind NLWeb directly to a public IP address, thus avoiding direct public exposure
- Configure monitoring systems to issue high-priority alerts for suspicious HTTP 404 or 400 error responses for URIs that have path traversal patterns
“This case study serves as a critical reminder that as we build new AI-powered systems, we must re-evaluate the impact of classic vulnerabilities, which now have the potential to compromise not just servers, but the ‘brains’ of AI agents themselves,” Guan said.
ITPro contacted Microsoft for comment on the report, but hadn’t received a response at the time of publication.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- NCSC says ‘limited number’ of UK firms affected by SharePoint attack
- SharePoint flaw: Microsoft says hackers deploying ransomware
- Warning issued after SharePoint flaw puts entire corporate networks at risk
-
Logitech says zero-day attack saw hackers copy 'certain data' from internal IT systemsNews The incident is believed to have formed part of a campaign by the Clop extortion group that targeted customers of Oracle’s E-Business Suite
-
IBM is targeting 'quantum advantage' in 12 monthsNews Leading organizations are already preparing for quantum computing, which could upend our understanding of linear mathematical problems
-
GitHub is awash with leaked AI company secrets – API keys, tokens, and credentials were all found out in the openNews Wiz research suggests AI leaders need to clean up their act when it comes to secrets leaking
-
A notorious ransomware group is spreading fake Microsoft Teams ads to snare victimsNews The Rhysida ransomware group is leveraging Trusted Signing from Microsoft to lend plausibility to its activities
-
CISA just published crucial new guidance on keeping Microsoft Exchange servers secureNews With a spate of attacks against Microsoft Exchange in recent years, CISA and the NSA have published crucial new guidance for organizations to shore up defenses.
-
CISA issues alert after botched Windows Server patch exposes critical flawNews A critical remote code execution flaw in Windows Server is being exploited in the wild, despite a previous 'fix'
-
Microsoft issues warning over “opportunistic” cyber criminals targeting big businessNews Microsoft has called on governments to do more to support organizations
-
Generative AI attacks are accelerating at an alarming rateNews Two new reports from Gartner highlight the new AI-related pressures companies face, and the tools they are using to counter them
-
A terrifying Microsoft flaw could’ve allowed hackers to compromise ‘every Entra ID tenant in the world’News The Entra ID vulnerability could have allowed full access to virtually all Azure customer accounts
-
Microsoft and Cloudflare just took down a major phishing operationNews RaccoonO365’s phishing as a service platform has risen to prominence via Telegram
