Microsoft patched a critical vulnerability in its NLWeb AI search tool – but there's no CVE (yet)

Microsoft headquarters in Shanghai, China, pictured with male employee walking in front entrance.

(Image credit: Getty Images)

published 7 August 2025

Security researchers have discovered a critical flaw in NLWeb, a new tool unveiled by Microsoft just over two months ago, that allows remote users to read sensitive files without authorization.

NLWeb is a so-called agentic AI tool that allows users to search web pages using a generative AI chatbot, which will remember the users’ preferences.

Ramanathan Guha, a technical fellow at Microsoft, demonstrated how this works using the website Serious Eats during Microsoft Build in May 2025.

While searching for recipes for the Hindu festival of Diwali, Guha mentioned to the chatbot that he is vegetarian. According to Guha, this means the website will only recommend vegetarian recipes when he’s searching for inspiration from now on.

So far, so useful, but it seems new and exciting tools open the door to new and exciting vulnerabilities.

The bug was discovered by Aonan Guan and Lei Wang in a security audit of the NLWeb open source repository.

According to Guan, who wrote about his discovery in a Medium post, the flaw “allowed any remote user to read sensitive files, including system configurations (/etc/passwd) and cloud credentials (.env files), using a simple, malformed URL”.

Guan identified a code block using os.path.normpath() that he said “immediately raised a red flag”.

“The function normalizes path separators but does not prevent a user from "climbing" out of the intended directory with ../ sequences. It's a classic path traversal flaw waiting to be exploited,” he noted.

Guan pointed to three separate oversights in the code that he said led to the vulnerability: improper sanitization, an expanded attack surface, and a lack of final path validation.

What’s being done about the NLWeb flaw?

While the flaw was discovered on 28 May and a vulnerability report submitted the same day, Guan has only just made his and Lei’s findings public.

Additionally, while Microsoft Security Response Center committed a patch on 30 June it confirmed to Guan on 1 July that it wouldn’t be issuing a CVE for the issue.

There is no suggestion from Guan that organizations deploying or experimenting with NLWeb should abandon their projects.

Instead he advises they:

Update their instance immediately “to any version including or after commit 8ffdb0f from the official GitHub repository”
Implement WAF/reverse proxy rules
Never bind NLWeb directly to a public IP address, thus avoiding direct public exposure
Configure monitoring systems to issue high-priority alerts for suspicious HTTP 404 or 400 error responses for URIs that have path traversal patterns

“This case study serves as a critical reminder that as we build new AI-powered systems, we must re-evaluate the impact of classic vulnerabilities, which now have the potential to compromise not just servers, but the ‘brains’ of AI agents themselves,” Guan said.

ITPro contacted Microsoft for comment on the report, but hadn’t received a response at the time of publication.

Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.

MORE FROM ITPRO

TOPICS

Jane McCallion is Managing Editor of ITPro and ChannelPro, specializing in data centers, enterprise IT infrastructure, and cybersecurity. Before becoming Managing Editor, she held the role of Deputy Editor and, prior to that, Features Editor, managing a pool of freelance and internal writers, while continuing to specialize in enterprise IT infrastructure, and business strategy.

Prior to joining ITPro, Jane was a freelance business journalist writing as both Jane McCallion and Jane Bordenave for titles such as European CEO, World Finance, and Business Excellence Magazine.