ACVE-2026-0205

The configuration

Configuration label

model.family glm-4.5 | family glm-4.5 + untrustedInput=true + sideEffect=true + approval never|allowlist

Affected entries

• Model: glm-4.5 — ECOSYSTEM (introduced 0)

Matcher

• all
  • any
    • all
      • model.id exists
      • model.family in [ "glm-4.5" ]
    • some models
      • family in [ "glm-4.5" ]
  • all
    • some tools
      • untrustedInput eq true
    • some tools
      • sideEffect eq true
  • approval in [ "never", "allowlist" ]

Threat

Attacker

content-author

Vector

prompt-injection

Outcome

arbitrary-command

Evidence

Why it is exploitable

What the vulnerability is

GLM-4.5 is a sharp example of template-mediated exposure. On InjecAgent, the baseline ASR is 0.0% and ChatInject raises it to 57.3%. On AgentDojo, the corresponding values are 0.3% and 20.3%. R7 treats these as verified primary numbers from the ChatInject paper. Both benchmark harnesses use simulated tool outputs, so the result is that a model follows a forged conversational boundary in an agent context; it is not direct evidence that a real shell command ran.

Which configuration is exposed

The exposed setup is GLM-4.5 with a public or inspectable chat template, a tool adapter that inserts external results into the conversation verbatim, and a side-effecting tool available under auto approval. A recognisable deployment is a zai-org/GLM-4.5 model in vLLM or Ollama behind an agent that fetches a web page or issue and also has filesystem, shell, or API-write capability. A tool may be untrusted without being side-effecting; risk appears when the two are connected.

How ACVE detects it

The advisory matches the GLM-4.5 model family in model or models[], then the untrustedInput and sideEffect tool witnesses, followed by never or allowlist approval. Exact model and tool metadata yield a confirmed result; an unpinned service alias or unknown model-server tools yield possible. The lock has no view of serialization middleware, token stripping, or server classifiers unless they are recorded in safeguards, so a clean-looking model identity does not prove the defence is present.

Fix

1. Install a template-token sanitiser at the tool boundary and test it against fake user, assistant, and turn markers. 2. Require agent.approval=ask for any write, execute, or egress operation. 3. Preserve the model template and tokenizer digests in the lock. 4. Re-run both baseline and ChatInject cases; the desired result is that the 0.0% baseline does not become 57.3% merely because external text is rendered.

Grounding needed

A reproduction should pin GLM-4.5 weights, quantisation, tokenizer and chat-template revision, the InjecAgent and AgentDojo/ChatInject commits, exact attack strings, seeds, tool serialization, and approval state. R7 confidence is M because the source is primary but the serving identity and size are not stated in the extracted result. Report simulated tools explicitly and do not claim that the paper measured egress or command completion.

Underlying CVEs / aliases

No CVE assigned. behavioural — no code defect; evidence is an evaluation

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Strip chat-template markers from GLM-4.5 tool output and ask before effects.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

EVIDENCE

• https://arxiv.org/html/2509.22830