CVE-2026-4399
Published: 31 March 2026
Summary
CVE-2026-4399 is a high-severity Command Injection (CWE-77) vulnerability in 1Millionbot Millie Chatbot. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as APIs and Models; in the LLM/Generative AI Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of user prompts to detect and block Boolean injection techniques that evade the chatbot's chat restrictions.
SI-15 filters chatbot outputs to prevent disclosure of prohibited information or execution of out-of-context responses triggered by injections.
CM-7 restricts the chatbot to least functionality essential for intended operations, limiting the scope of abuse from injected out-of-context tasks using service resources or API keys.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability in a public-facing chatbot allows remote unauthenticated exploitation over the network, directly enabling T1190. Prompt injection facilitates execution of injected instructions that leverage cloud APIs and resources (e.g., OpenAI API key), mapping to T1059.009.
NVD Description
Prompt injection vulnerability in 1millionbot Millie chatbot that occurs when a user manages to evade chat restrictions using Boolean prompt injection techniques (formulating a question in such a way that, upon receiving an affirmative response ('true'), the model executes the…
more
injected instruction), causing it to return prohibited information and information outside its intended context. Successful exploitation of this vulnerability could allow a malicious remote attacker to abuse the service for purposes other than those originally intended, or even execute out-of-context tasks using 1millionbot's resources and/or OpenAI's API key. This allows the attacker to evade the containment mechanisms implemented during LLM model training and obtain responses or chat behaviors that were originally restricted.
Deeper analysisAI
CVE-2026-4399 is a prompt injection vulnerability affecting the 1millionbot Millie chatbot. It enables users to evade chat restrictions through Boolean prompt injection techniques, where a specially formulated question triggers the model to execute an injected instruction upon receiving an affirmative 'true' response. This flaw causes the chatbot to return prohibited information or responses outside its intended context, bypassing containment mechanisms implemented during LLM model training. The vulnerability is classified under CWE-77 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and was published on 2026-03-31.
A malicious remote attacker can exploit this vulnerability without privileges or user interaction over the network with low complexity. Successful exploitation allows the attacker to abuse the service for unintended purposes, execute out-of-context tasks, and leverage 1millionbot's resources or even OpenAI's API key, thereby evading original restrictions on chat behaviors.
The INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-1millionbot-millie-chatbot documents this issue among multiple vulnerabilities in the 1millionbot Millie chatbot.
This vulnerability highlights prompt injection risks in LLM-based chatbots, demonstrating how attackers can manipulate model outputs to perform unauthorized actions using provider resources.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- APIs and Models
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: prompt injection, prompt injection, openai, llm