letta-ai letta 不完全な修正 CVE-2025-6101 ast_parsers.py resolve_type eval インジェクション

Successful exploitation of CVE-2026-4965 allows an attacker to inject and execute arbitrary code on the system running letta-ai letta. This can lead to complete system compromise, including data theft, modification, or destruction. Given the availability of a public exploit, the potential for widespread exploitation is significant. The attack vector is remote, meaning an attacker does not need local access to exploit the vulnerability. This vulnerability builds upon an incomplete fix for CVE-2025-6101, suggesting a history of similar issues within the project.

Organizations and individuals using letta-ai letta version 0.16.4, particularly those deploying it in production environments or integrating it with other critical systems, are at significant risk. Systems where letta-ai letta processes user-supplied data without proper sanitization are especially vulnerable.

• python / supply-chain:

import os
import subprocess

# Check for the vulnerable version of letta-ai letta
process = subprocess.run(['pip', 'show', 'letta-ai'], capture_output=True, text=True)
output = process.stdout
if 'Version: 0.16.4' in output:
    print('Vulnerable version detected!')

• generic web: Check for unusual process executions or network connections originating from the letta-ai letta process. Monitor access logs for suspicious requests containing potentially malicious code.

1. 2026-03-27Disclosure

   disclosure

2. 2026-03-27PoC

   poc

1. 予約済み2026-03-27
2. 公開日2026-03-27
3. EPSS 更新日2026-04-04

The primary mitigation for CVE-2026-4965 is to upgrade to a patched version of letta-ai letta. As no fixed version is currently specified, carefully review the project's release notes and consider rolling back to a previous, known-stable version if the upgrade introduces compatibility issues. Implement input validation and sanitization on any user-supplied data used in dynamically evaluated code. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests. Monitor system logs for unusual activity or attempts to execute arbitrary commands.