{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0204",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Qwen 3 ChatInject reaches 54.8% ASR, with 45.2% on Qwen3-4B Universal TAP.",
  "details": "## What the vulnerability is\n\nQwen 3 shows a large format-dependent injection gap. The ChatInject paper reports AgentDojo ASR rising from 17.5% to 54.8%, with a 69.4% multi-tool variant flagged as inferred in R7; InjecAgent rises from 8.5% to 39.4%. A white-box Qwen3-4B Universal TAP run reports 45.2% over 80 task pairs, with transfer to Qwen3-32B and 235B at 24.7% to 36.0% without re-optimisation. The live 2026 competition reports 5.5% per-attempt for Qwen3 VL 235B. The first two benchmarks simulate tools; the competition runs live agents.\n\n## Which configuration is exposed\n\nThis advisory covers Qwen3 family deployments, including Qwen3-VL-235B, where external content enters a tool-calling prompt and side-effecting tools remain callable under auto approval. Concrete examples include a Qwen3 Ollama tag behind Open WebUI with a web fetch plus shell tool, or a Qwen3-VL browser agent that can submit forms without confirmation. untrustedInput, sideEffect, and egress are separate concerns: an issue reader can be untrusted, a file writer can have side effects, and an HTTP client can exfiltrate.\n\n## How ACVE detects it\n\nACVE matches qwen3 in the selected model or a models[] fallback, then requires a tool with untrustedInput and another with sideEffect and approval never or allowlist. A pinned Qwen3-VL identity with enumerated tools can be confirmed. A qwen3:latest or undated API alias is only possible, as is a model server that hides its tool set. The matcher cannot observe whether a template-token sanitiser or classifier actually ran; discovery must place those controls in safeguards.\n\n## Fix\n\n1. Sanitise role and turn tokens in every tool result before the Qwen3 chat template sees it. 2. Add a classifier for indirect injection and fail closed on uncertain tool output. 3. Require approval for side-effecting calls. 4. For a 4B local agent, do not rely on transfer robustness: the measured 45.2% Universal TAP ASR is still high. Record the exact template digest and repeat the same attack suite after each quantisation or serving change.\n\n## Grounding needed\n\nPin the Qwen3 size, Qwen3-VL 235B API snapshot or local digest, quantisation, tokenizer/template, benchmark commits, 80 Universal TAP task pairs where used, seeds, and tool approval. R7 assigns H confidence to the competition and primary ChatInject figures, but M to the size-unspecified API row; the 69.4% multi-tool number is inferred. State explicitly which tools were simulated and which were live.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "qwen3"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2509.22830"
    },
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2606.10525v1"
    },
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2603.15714"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01",
          "ASI06"
        ],
        "owasp_llm": [
          "LLM01"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "prompt-injection",
        "outcome": "arbitrary-command"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "AgentDojo baseline",
          "benchmarkVersion": "2024",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.175,
          "model": {
            "id": "Qwen 3",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2509.22830",
          "note": "simulated tools; size not stated"
        },
        {
          "kind": "eval",
          "benchmark": "AgentDojo ChatInject",
          "benchmarkVersion": "2024",
          "attack": "forged chat-template turns in tool output",
          "defense": "none",
          "metric": "asr",
          "value": 0.548,
          "model": {
            "id": "Qwen 3",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2509.22830",
          "note": "simulated tools; size not stated"
        },
        {
          "kind": "eval",
          "benchmark": "AgentDojo ChatInject multi-tool",
          "benchmarkVersion": "2024",
          "attack": "forged chat-template turns in tool output",
          "defense": "none",
          "metric": "asr",
          "value": 0.694,
          "model": {
            "id": "Qwen 3",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated multi-tool agent"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2509.22830",
          "note": "secondary source; size not stated"
        },
        {
          "kind": "eval",
          "benchmark": "InjecAgent baseline",
          "benchmarkVersion": "2024",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.085,
          "model": {
            "id": "Qwen 3",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2509.22830",
          "note": "simulated tools; size not stated"
        },
        {
          "kind": "eval",
          "benchmark": "InjecAgent ChatInject",
          "benchmarkVersion": "2024",
          "attack": "forged chat-template turns in tool output",
          "defense": "none",
          "metric": "asr",
          "value": 0.394,
          "model": {
            "id": "Qwen 3",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2509.22830",
          "note": "simulated tools; size not stated"
        },
        {
          "kind": "eval",
          "benchmark": "Universal TAP",
          "benchmarkVersion": "2026",
          "attack": "Universal TAP indirect injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.452,
          "model": {
            "id": "Qwen3-4B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "simulated task pairs"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2606.10525v1",
          "note": "simulated tools; 80 task pairs"
        },
        {
          "kind": "eval",
          "benchmark": "Universal TAP transfer",
          "benchmarkVersion": "2026",
          "attack": "Universal TAP transfer",
          "defense": "none",
          "metric": "asr",
          "value": 0.247,
          "model": {
            "id": "Qwen3-32B/235B",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated task pairs"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2606.10525v1",
          "note": "comparison; transfer lower bound without re-optimisation"
        },
        {
          "kind": "eval",
          "benchmark": "Universal TAP transfer",
          "benchmarkVersion": "2026",
          "attack": "Universal TAP transfer",
          "defense": "none",
          "metric": "asr",
          "value": 0.36,
          "model": {
            "id": "Qwen3-32B/235B",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated task pairs"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2606.10525v1",
          "note": "comparison; transfer upper bound without re-optimisation"
        },
        {
          "kind": "eval",
          "benchmark": "2026 IPI competition",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.055,
          "model": {
            "id": "Qwen3 VL 235B",
            "quant": null
          },
          "setup": {
            "tools": [
              "live tool, coding, and computer-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2603.15714",
          "note": "competition per-attempt"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "qwen3"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "qwen3"
                  ]
                }
              }
            ]
          },
          {
            "all": [
              {
                "some": "tools",
                "where": {
                  "field": "untrustedInput",
                  "op": "eq",
                  "value": true
                }
              },
              {
                "some": "tools",
                "where": {
                  "field": "sideEffect",
                  "op": "eq",
                  "value": true
                }
              }
            ]
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Sanitise Qwen 3 tool output, classify injections, and require approval.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "defence:template-token sanitiser",
            "to": "on",
            "why": "The largest cited deltas are caused by forged role and turn markers."
          },
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "Prevent an untrusted Qwen 3 result from directly selecting a side effect."
          },
          {
            "type": "reconfigure",
            "target": "defence:classifier",
            "to": "on",
            "why": "Use an injection classifier before the action planner and fail closed on uncertainty."
          }
        ]
      }
    }
  }
}