{"id":747,"date":"2026-04-21T23:12:51","date_gmt":"2026-04-21T16:12:51","guid":{"rendered":"https:\/\/vncybers.vn\/google-va-lo-hong-nghiem-trong-cve-2026-21520-tren-antigravity-ide-prompt-injection-co-the-thuc-thi-ma-tuy-y\/"},"modified":"2026-04-23T21:26:48","modified_gmt":"2026-04-23T14:26:48","slug":"google-va-lo-hong-nghiem-trong-cve-2026-21520-tren-antigravity-ide-prompt-injection-co-the-thuc-thi-ma-tuy-y","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/google-va-lo-hong-nghiem-trong-cve-2026-21520-tren-antigravity-ide-prompt-injection-co-the-thuc-thi-ma-tuy-y\/","title":{"rendered":"Google v\u00e1 l\u1ed7 h\u1ed5ng CVE-2026-21520: Prompt Injection cho ph\u00e9p th\u1ef1c thi m\u00e3 t\u00f9y \u00fd"},"content":{"rendered":"
\"L\u1ed7<\/figure>\n\n\n\n

Google v\u1eeba ph\u00e1t h\u00e0nh b\u1ea3n v\u00e1 cho m\u1ed9t l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt nghi\u00eam tr\u1ecdng mang m\u00e3 CVE-2026-21520<\/strong> \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn Antigravity<\/strong>, IDE t\u00edch h\u1ee3p AI c\u1ee7a h\u00e3ng. L\u1ed7 h\u1ed5ng n\u00e0y cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng th\u1ef1c hi\u1ec7n prompt injection<\/strong> \u0111\u1ec3 tho\u00e1t kh\u1ecfi sandbox b\u1ea3o m\u1eadt v\u00e0 th\u1ef1c thi m\u00e3 t\u00f9y \u00fd tr\u00ean h\u1ec7 th\u1ed1ng c\u1ee7a n\u1ea1n nh\u00e2n.<\/p>\n\n\n\n

Strict Mode b\u1ecb v\u01b0\u1ee3t qua nh\u01b0 th\u1ebf n\u00e0o?<\/h2>\n\n\n

Antigravity c\u00f3 t\u00ednh n\u0103ng Strict Mode<\/strong>, ch\u1ebf \u0111\u1ed9 b\u1ea3o m\u1eadt cao nh\u1ea5t, gi\u1edbi h\u1ea1n truy c\u1eadp m\u1ea1ng, ng\u0103n ghi file ngo\u00e0i workspace v\u00e0 \u0111\u1ea3m b\u1ea3o m\u1ecdi l\u1ec7nh ch\u1ea1y trong sandbox. Tuy nhi\u00ean, nh\u00e0 nghi\u00ean c\u1ee9u Bar Kaduri<\/strong> t\u1eeb Capsule Security ph\u00e1t hi\u1ec7n c\u00e1ch v\u01b0\u1ee3t qua to\u00e0n b\u1ed9 l\u1edbp b\u1ea3o v\u1ec7 n\u00e0y:<\/p>\n\n\n\n

  • K\u1ebft h\u1ee3p kh\u1ea3 n\u0103ng t\u1ea1o file<\/strong> c\u1ee7a Antigravity v\u1edbi l\u1ed7 h\u1ed5ng thi\u1ebfu sanitize input trong c\u00f4ng c\u1ee5 find_by_name<\/strong><\/li>
  • Inject l\u1ec7nh \u0111\u1ed9c h\u1ea1i th\u00f4ng qua d\u1eef li\u1ec7u kh\u00f4ng \u0111\u00e1ng tin c\u1eady do ng\u01b0\u1eddi d\u00f9ng cung c\u1ea5p<\/li>
  • H\u1ec7 th\u1ed1ng AI kh\u00f4ng ph\u00e2n bi\u1ec7t \u0111\u01b0\u1ee3c \u0111\u00e2u l\u00e0 system instruction<\/strong>, \u0111\u00e2u l\u00e0 d\u1eef li\u1ec7u ng\u01b0\u1eddi d\u00f9ng<\/strong><\/li><\/ul>\n\n\n\n

    Nh\u00e0 nghi\u00ean c\u1ee9u Bar Kaduri m\u00f4 t\u1ea3: “Cu\u1ed9c t\u1ea5n c\u00f4ng khai th\u00e1c vi\u1ec7c thi\u1ebfu input sanitization v\u00e0 s\u1ef1 ph\u00e2n t\u00e1ch kh\u00f4ng \u0111\u1ea7y \u0111\u1ee7 gi\u1eefa system instruction v\u00e0 d\u1eef li\u1ec7u do ng\u01b0\u1eddi d\u00f9ng cung c\u1ea5p.”<\/em><\/p>\n\n\n\n

    Xu h\u01b0\u1edbng nguy hi\u1ec3m: Agentic IDE tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau<\/h2>\n\n\n

    CVE-2026-21520 kh\u00f4ng ph\u1ea3i tr\u01b0\u1eddng h\u1ee3p \u0111\u01a1n l\u1ebb. N\u0103m 2025-2026 ch\u1ee9ng ki\u1ebfn h\u00e0ng lo\u1ea1t l\u1ed7 h\u1ed5ng t\u01b0\u01a1ng t\u1ef1 tr\u00ean c\u00e1c IDE AI ph\u1ed5 bi\u1ebfn:<\/p>\n\n\n\n

    • Cursor<\/strong>, CVE-2026-22708: RCE qua indirect prompt injection v\u00e0o shell built-in commands<\/li>
    • Microsoft Copilot Studio<\/strong>, “ShareLeak”: prompt injection qua form fields, l\u1ed9 d\u1eef li\u1ec7u l\u1ecbch Google<\/li>
    • Cursor, Windsurf, Antigravity, Trae<\/strong>, \u0111\u1ec1 xu\u1ea5t extension kh\u00f4ng t\u1ed3n t\u1ea1i tr\u00ean Open VSX, t\u1ea1o nguy c\u01a1 supply chain attack<\/li><\/ul>\n\n\n\n

      \u0110i\u1ec3m chung: c\u00e1c c\u00f4ng c\u1ee5 AI th\u1ebf h\u1ec7 m\u1edbi \u0111\u01b0\u1ee3c trao quy\u1ec1n h\u1ea1n r\u1ea5t l\u1edbn (\u0111\u1ecdc\/ghi file, ch\u1ea1y l\u1ec7nh, truy c\u1eadp m\u1ea1ng) nh\u01b0ng ch\u01b0a c\u00f3 c\u01a1 ch\u1ebf ph\u00e2n t\u00e1ch tin c\u1eady \u0111\u1ee7 m\u1ea1nh gi\u1eefa d\u1eef li\u1ec7u v\u00e0 l\u1ec7nh.<\/p>\n\n\n\n

      Khuy\u1ebfn ngh\u1ecb cho l\u1eadp tr\u00ecnh vi\u00ean<\/h2>\n\n\n
      1. C\u1eadp nh\u1eadt ngay<\/strong> Antigravity IDE l\u00ean phi\u00ean b\u1ea3n m\u1edbi nh\u1ea5t c\u00f3 b\u1ea3n v\u00e1 CVE-2026-21520<\/li>
      2. Kh\u00f4ng d\u00f9ng Strict Mode l\u00e0m l\u00e1 ch\u1eafn duy nh\u1ea5t<\/strong>, k\u1ebft h\u1ee3p v\u1edbi nguy\u00ean t\u1eafc least privilege \u1edf c\u1ea5p OS<\/li>
      3. C\u1ea9n th\u1eadn v\u1edbi prompt t\u1eeb ngu\u1ed3n b\u00ean ngo\u00e0i<\/strong>, file, URL, d\u1eef li\u1ec7u API \u0111\u1ec1u c\u00f3 th\u1ec3 ch\u1ee9a injection<\/li>
      4. Ki\u1ec3m tra extension<\/strong> tr\u00ean Open VSX tr\u01b0\u1edbc khi c\u00e0i, \u0111\u1ea3m b\u1ea3o package t\u1ed3n t\u1ea1i v\u00e0 c\u00f3 publisher h\u1ee3p l\u1ec7<\/li>
      5. Sandbox m\u00f4i tr\u01b0\u1eddng ph\u00e1t tri\u1ec3n<\/strong>, d\u00f9ng container ho\u1eb7c VM \u0111\u1ec3 c\u00f4 l\u1eadp t\u00e1c \u0111\u1ed9ng n\u1ebfu b\u1ecb khai th\u00e1c<\/li><\/ol>\n\n\n\n

         <\/p>\n\n\n

        VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb: The Hacker News, CyberScoop, Capsule Security, Mindgard AI, C\u1eadp nh\u1eadt ng\u00e0y 21\/4\/2026<\/em><\/p>","protected":false},"excerpt":{"rendered":"

        L\u1ed7 h\u1ed5ng CVE-2026-21520 tr\u00ean IDE AI Antigravity c\u1ee7a Google cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng v\u01b0\u1ee3t qua ch\u1ebf \u0111\u1ed9 Strict Mode th\u00f4ng qua prompt injection, d\u1eabn \u0111\u1ebfn th\u1ef1c thi m\u00e3 t\u00f9y \u00fd ngo\u00e0i sandbox. Google \u0111\u00e3 v\u00e1 l\u1ed7i nh\u01b0ng v\u1ea5n \u0111\u1ec1 ki\u1ebfn tr\u00fac v\u1eabn c\u00f2n \u0111\u00f3.<\/p>","protected":false},"author":2,"featured_media":744,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[21,35,41,34,42],"class_list":["post-747","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-ai","tag-cve","tag-google","tag-lo-hong-bao-mat","tag-prompt-injection"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/747","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=747"}],"version-history":[{"count":9,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/747\/revisions"}],"predecessor-version":[{"id":1086,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/747\/revisions\/1086"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/744"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=747"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=747"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=747"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}