Rovo AI Prompt Injection Exposes Jira Data, Webmail XSS, Metabase Admin Access

Atlassian’s Rovo assistant has been shown to accept attacker‑controlled instructions that cause it to collect Jira or Confluence data accessible by the signed‑in user and forward that information to an external server. PromptArmor discovered this behavior when they found hidden instructions embedded in content that Rovo reads; only one of the two independent attack routes identified was confirmed closed at the time of writing.¹

The vulnerability stems from Rovo’s instruction‑following architecture built on large language models (LLMs). LLM prompt injection is a known risk; experts note that adversarial prompts can trigger unintended actions even with safety training measures in place. The threat includes not just exfiltration but also potential manipulation through malicious instructions that could lead users into revealing sensitive information or performing unauthorized actions within their organization—a form of social engineering amplified by AI interaction.

New research demonstrates that email content can escape its message boundary and interfere with the webmail interface. Across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, these techniques capture passwords, take over third‑party accounts, leak tokens, hijack trusted UI actions, and manipulate AI tools that read email. The core issue lies in how webmail interfaces parse HTML/CSS without sufficient sanitization before rendering it within the user context, effectively enabling cross‑site scripting (XSS) vulnerabilities that have plagued online services since 1999. Experts explain that such flaws often persist because they require deep knowledge of browser internals combined with careful crafting of input payloads.¹

Metabase has warned that a maximum‑severity flaw impacting its business intelligence and data visualization software package was exploited as a zero‑day. With a CVSS score of 10.0 and no CVE identifier, the vulnerability allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, giving them admin access. Metabase relies heavily on SQL databases—likely PostgreSQL given its open source nature—which means attackers can bypass authentication entirely if they inject commands directly into those interactions. Similar zero days targeting other BI tools are common; for example, Logi Analytics suffered a remote command execution flaw exploited for months prior to public disclosure in late 2024, resulting in widespread corporate espionage cases. This underscores that even well‑regarded data platforms remain vulnerable to fundamental injection attacks despite decades of security research.¹