ACVE-2026-0204

The configuration

Configuration label

model.family qwen3 | family qwen3 + untrustedInput=true + sideEffect=true + approval never|allowlist

Affected entries

• Model: qwen3 — ECOSYSTEM (introduced 0)

Matcher

• all
  • any
    • all
      • model.id exists
      • model.family in [ "qwen3" ]
    • some models
      • family in [ "qwen3" ]
  • all
    • some tools
      • untrustedInput eq true
    • some tools
      • sideEffect eq true
  • approval in [ "never", "allowlist" ]

Threat

Attacker

content-author

Vector

prompt-injection

Outcome

arbitrary-command

Evidence

Why it is exploitable

What the vulnerability is

Qwen 3 shows a large format-dependent injection gap. The ChatInject paper reports AgentDojo ASR rising from 17.5% to 54.8%, with a 69.4% multi-tool variant flagged as inferred in R7; InjecAgent rises from 8.5% to 39.4%. A white-box Qwen3-4B Universal TAP run reports 45.2% over 80 task pairs, with transfer to Qwen3-32B and 235B at 24.7% to 36.0% without re-optimisation. The live 2026 competition reports 5.5% per-attempt for Qwen3 VL 235B. The first two benchmarks simulate tools; the competition runs live agents.

Which configuration is exposed

This advisory covers Qwen3 family deployments, including Qwen3-VL-235B, where external content enters a tool-calling prompt and side-effecting tools remain callable under auto approval. Concrete examples include a Qwen3 Ollama tag behind Open WebUI with a web fetch plus shell tool, or a Qwen3-VL browser agent that can submit forms without confirmation. untrustedInput, sideEffect, and egress are separate concerns: an issue reader can be untrusted, a file writer can have side effects, and an HTTP client can exfiltrate.

How ACVE detects it

ACVE matches qwen3 in the selected model or a models[] fallback, then requires a tool with untrustedInput and another with sideEffect and approval never or allowlist. A pinned Qwen3-VL identity with enumerated tools can be confirmed. A qwen3:latest or undated API alias is only possible, as is a model server that hides its tool set. The matcher cannot observe whether a template-token sanitiser or classifier actually ran; discovery must place those controls in safeguards.

Fix

1. Sanitise role and turn tokens in every tool result before the Qwen3 chat template sees it. 2. Add a classifier for indirect injection and fail closed on uncertain tool output. 3. Require approval for side-effecting calls. 4. For a 4B local agent, do not rely on transfer robustness: the measured 45.2% Universal TAP ASR is still high. Record the exact template digest and repeat the same attack suite after each quantisation or serving change.

Grounding needed

Pin the Qwen3 size, Qwen3-VL 235B API snapshot or local digest, quantisation, tokenizer/template, benchmark commits, 80 Universal TAP task pairs where used, seeds, and tool approval. R7 assigns H confidence to the competition and primary ChatInject figures, but M to the size-unspecified API row; the 69.4% multi-tool number is inferred. State explicitly which tools were simulated and which were live.

Underlying CVEs / aliases

No CVE assigned. behavioural — no code defect; evidence is an evaluation

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Sanitise Qwen 3 tool output, classify injections, and require approval.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

EVIDENCE

• https://arxiv.org/html/2509.22830
• https://arxiv.org/html/2606.10525v1
• https://arxiv.org/html/2603.15714