Character cards are untrusted input: local RP app audit finds file deletion and DNS rebinding bugs
Possible_Statement84 · reddit · 2026-10-20
The developer of Vellium, an open-source local-model roleplay/writing app, disclosed security bugs worth knowing for anyone building local LLM frontends:
- Malicious character cards: the app stored a card's avatar field as a file path and deleted the old file on avatar change — a card containing ../../ plus a path could delete arbitrary files; a web link in the field leaked the user's IP on every load, like an email tracking pixel. Affects 0.2.3–1.6.0, fixed in 1.7
- DNS rebinding + exposed keys: the local server answered requests from any domain pointing at the machine, letting any open website talk to it, and the settings endpoint returned TTS/STT API keys unmasked. Both fixed in 1.7
The author's takeaway: a character card is a file from a stranger and any field can contain anything. The post also covers Vellium's features: auto-discovery of llama.cpp/GGUF models, direct llama-server integration, a token-level context view, SillyTavern World Info import, and voice mode.
More from Safety
- Bug bounty programs expand scope and raise rewards in the AI era — rez0__ · 2026-10-20
- CyberArena benchmarks AI agents in live attack-and-defense combat — 2077AIDataFoundation · 2026-10-20
- Dev details how to let an MCP agent delete files safely: HMAC preview tokens and deny lists — qupit · 2026-10-20
- Swiggy refuses user's request for a copy of their personal data — kingslyj · 2026-10-20
- Security researcher urges bug hunters to tell programs why they're walking away — rez0__ · 2026-10-20
- Paper Claims ChatGPT Secretly Profiles 96% of Users' Psychology, Sparking Moat Debate — robleclerc · 2026-10-20