What is the CVSS score of CVE-2026-31231?

CVE-2026-31231 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Cognee are affected by CVE-2026-31231?

Cognee v0.4.0 and earlier contains a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary code on affected servers, potentially compromising all data…

How to fix or mitigate CVE-2026-31231?

Within 24 hours: Identify all instances of Cognee v0.4.0 or earlier in production and development environments; take affected systems offline or restrict network access to trusted networks only. Within 7 days: Monitor the Cognee project repository and vendor advisory channels for patch availability; document all systems running Cognee versions in scope. Within 30 days: Deploy patched version immediately upon vendor release, or migrate to alternative AI/ML pipeline solutions if no patch timeline is published.

Cognee CVE-2026-31231

EUVD-2026-29554 CRITICAL

Code Injection (CWE-94)

2026-05-12 mitre

GHSA-fcch-9ph8-q3p4

Python RCE Code Injection N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 21:30 vuln.today

CVSS changed

May 15, 2026 - 19:22 NVD

9.8 (CRITICAL)

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Cognee thru v0.4.0 contains a critical remote code execution vulnerability in its notebook cell execution API endpoint. The endpoint is designed to execute arbitrary Python code provided by the user, but it does so using the unsafe exec() function without any sandboxing, validation, or security controls. An attacker can exploit this by sending a specially crafted POST request containing malicious Python code to the execution endpoint. This leads to arbitrary code execution on the Cognee server with the privileges of the server process, allowing complete compromise of the system.

AnalysisAI

Remote code execution in Cognee v0.4.0 and earlier allows unauthenticated attackers to execute arbitrary Python code via the notebook cell execution API endpoint. The vulnerability stems from unsafe use of Python's exec() function without sandboxing or validation, enabling complete system compromise with server process privileges. While not actively exploited (not in KEV), the vulnerability is automatable with total technical impact per SSVC framework, though EPSS indicates low exploitation probability at 0.06%.

Technical ContextAI

Cognee's notebook cell execution API is designed to dynamically execute Python code, likely for interactive data processing or analysis workflows. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code), where user-supplied Python code is passed directly to the exec() function without security controls. This design pattern is inherently dangerous as Python's exec() provides full access to the interpreter environment, including system calls, file operations, and network access. The CPE data shows incomplete product identification, suggesting this may be a newer or less mainstream project.

RemediationAI

No vendor-released patch identified at time of analysis. The Notion page reference (https://www.notion.so/CVE-2026-31231-35d1e13931888178a963ef9efeb29113) may contain additional details but requires access verification. Until a patch is available, disable the notebook cell execution API endpoint entirely if not required for core functionality. If the endpoint must remain active, implement API authentication using strong tokens or certificates, restrict access via firewall rules to trusted IP ranges only, and consider deploying a Python sandboxing solution like RestrictedPython or running the execution in isolated containers with limited privileges. Each mitigation has trade-offs: disabling the endpoint breaks notebook functionality, authentication adds complexity, and sandboxing may limit legitimate code execution capabilities.