A vulnerability was detected in letta-ai letta 0.16.4. This issue affects the function resolve_type of the file letta/functions/ast_parsers.py of the component …

Published:

26 maart 2026 om 23:00:00

Alert date:

27 maart 2026 om 20:07:04

Source:

nvd.nist.gov

Web Technologies, Supply Chain & Dependencies

A remote code injection vulnerability (CVE-2026-4965) was discovered in letta-ai letta version 0.16.4, affecting the resolve_type function in ast_parsers.py. This vulnerability represents an incomplete fix for CVE-2025-6101 and allows improper neutralization of directives in dynamically evaluated code. The attack can be initiated remotely and exploits are now publicly available. The vendor was contacted but did not respond to disclosure attempts.

Technical details

Mitigation steps:

Affected products:

letta-ai letta