CVE-2026-4965
letta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injection
- State
- Published
- Severity
- 6.9 Medium
- Published
- Mar 27, 2026
- Updated
- Mar 27, 2026
- Reserved
- Mar 27, 2026
Description
A vulnerability was detected in letta-ai letta 0.16.4. This issue affects the function resolve_type of the file letta/functions/ast_parsers.py of the component Incomplete Fix CVE-2025-6101. Performing a manipulation results in improper neutralization of directives in dynamically evaluated code. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
lettaletta-ai |
|
References
- VDB-353842 | letta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injectionvdb-entrytechnical-description
- VDB-353842 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #777654 | letta-ai letta 0.16.4 CWE-95third-party-advisory
- https://gist.github.com/YLChen-007/fc09bc447a73bba526c1642d9ce73ca5exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.