EUVD-2026-16727
GHSA-4f2v-q2vh-v8hc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A security vulnerability has been detected in letta-ai letta 0.16.4. This vulnerability affects the function _convert_message_create_to_message of the file letta/helpers/message_helper.py of the component File URL Handler. Such manipulation of the argument ImageContent leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
AnalysisAI
Server-side request forgery in letta-ai letta 0.16.4 allows authenticated remote attackers to manipulate ImageContent parameters in the _convert_message_create_to_message function within the file URL handler, enabling arbitrary HTTP requests to internal or external systems. Letta versions up to and including 0.16.4 are affected. Publicly available exploit code exists, and the vendor has not responded to early disclosure notifications, leaving affected deployments without an official patch at time of analysis.
Technical ContextAI
The vulnerability resides in the file URL handler component (specifically letta/helpers/message_helper.py) of the letta-ai letta framework, classified under CWE-918 (Server-Side Request Forgery). The root cause stems from insufficient validation of user-supplied ImageContent arguments before they are processed by the _convert_message_create_to_message function. This function likely constructs HTTP requests based on user input without proper sanitization or allowlisting, permitting an attacker to craft malicious image URLs that redirect to internal services, cloud metadata endpoints (e.g., AWS IMDSv1), or external targets. The CPE cpe:2.3:a:letta-ai:letta:*:*:*:*:*:*:*:* indicates all versions of letta-ai letta are potentially affected across all configurations and platforms, though 0.16.4 is explicitly confirmed vulnerable.
RemediationAI
Contact letta-ai for an available patched version; if a fix has been released post-0.16.4, upgrade immediately to the latest stable release. If no official patch is available, implement network-level mitigations: restrict outbound HTTP/HTTPS connections from letta processes to a whitelist of trusted internal and external services using egress firewall rules or iptables. Disable or restrict the file URL handler feature if it is not actively required in your deployment. Additionally, validate and sanitize all ImageContent parameters at the application level by enforcing a strict allowlist of permitted image domains and rejecting requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) and cloud metadata endpoints. Monitor outbound traffic from letta instances for suspicious requests. Consult VulDB submission https://vuldb.com/?submit.777645 for any vendor updates or community-provided patches.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today