letta-ai letta Unvollständige Behebung CVE-2025-6101 ast_parsers.py resolve_type eval Injektion

Successful exploitation of CVE-2026-4965 allows an attacker to inject and execute arbitrary code on the affected system. This can lead to complete system compromise, including data exfiltration, privilege escalation, and the installation of malware. Given the remote nature of the attack and the availability of a public exploit, the potential blast radius is significant, particularly for environments where letta-ai letta is exposed to untrusted networks. The vulnerability's connection to an incomplete fix for CVE-2025-6101 suggests a potential history of similar issues and a need for thorough code review.

Organizations and individuals using letta-ai letta version 0.16.4, particularly those deploying it in production environments or integrating it with other critical systems, are at significant risk. Systems where letta-ai letta processes user-supplied data without proper sanitization are especially vulnerable.

• python / supply-chain:

import os
import subprocess

# Check for the vulnerable version of letta-ai letta
process = subprocess.run(['pip', 'show', 'letta-ai'], capture_output=True, text=True)
output = process.stdout
if 'Version: 0.16.4' in output:
    print('Vulnerable version detected!')

• generic web: Check for unusual process executions or network connections originating from the letta-ai letta process. Monitor access logs for suspicious requests containing potentially malicious code.

1. 2026-03-27Disclosure

   disclosure

2. 2026-03-27PoC

   poc

1. Reserviert2026-03-27
2. Veröffentlicht2026-03-27
3. EPSS aktualisiert2026-04-04

The primary mitigation for CVE-2026-4965 is to upgrade to a patched version of letta-ai letta. Unfortunately, no fixed version is currently specified. As a temporary workaround, consider implementing strict input validation and sanitization on any data passed to the resolvetype function within letta/functions/astparsers.py. Web application firewalls (WAFs) configured to detect and block code injection attempts can also provide a layer of defense. Monitor system logs for suspicious activity related to the resolve_type function or any unusual process execution.