EUVD-2026-41709
GHSA-v6hv-2p8r-43v4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no authentication or interaction required; impact is limited to low integrity on search results with no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the file InsightEngine/agent.py of the component InsightEngine search-result Deduplication. Executing a manipulation can lead to partial string comparison. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
AnalysisAI
Partial string comparison in BettaFish's InsightEngine deduplication logic (versions up to 1.2.1) allows remote unauthenticated attackers to manipulate search-result deduplication by crafting inputs that exploit the flawed comparison in _deduplicate_results within InsightEngine/agent.py. The integrity impact is limited - attackers can cause duplicate or otherwise manipulated entries to persist in search output - but the attack requires no authentication and no user interaction, and a public proof-of-concept exploit exists. No active exploitation has been confirmed by CISA KEV; a fix pull request (PR #689) has been submitted but not yet merged.
Technical ContextAI
CWE-187 (Partial String Comparison) describes a class of defect where a comparison function checks only a prefix, suffix, or substring instead of the full string, causing logic to incorrectly equate or distinguish values. In BettaFish, the affected function _deduplicate_results in InsightEngine/agent.py uses such a partial comparison to identify and remove duplicate entries from search results. An attacker who can influence search query inputs or result content can craft strings that are considered equal or unequal to others based on the partial comparison, bypassing deduplication. BettaFish appears to be a Python-based application (inferred from .py file extension and GitHub repository structure). The CPE string cpe:2.3:a:666ghj:bettafish:*:*:*:*:*:*:*:* confirms all versions up to and including 1.2.1 are within scope.
RemediationAI
An upstream fix is available as a pending pull request (PR #689) at https://github.com/666ghj/BettaFish/pull/689, but it has not yet been merged or released as a tagged version - operators should monitor the repository and upgrade once a patched release is published. Until then, the primary compensating control is to restrict network access to BettaFish's InsightEngine search endpoint, limiting exposure to trusted clients only; this eliminates the unauthenticated remote attack surface but may reduce search availability. Additionally, operators can implement input validation or sanitization upstream of the _deduplicate_results function to reject or normalize strings that could exploit partial-comparison edge cases, though this requires code-level changes. No exact patched version number has been independently confirmed; do not assume a specific release contains the fix until PR #689 is merged and tagged.
Same weakness CWE-187 – Partial String Comparison
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today