Which versions of Letta are affected by EUVD-2026-16736?

Organizations using A vulnerability should be aware of notable risk from CVE-2026-4965, a eval injection vulnerability rated CVSS 6.9.

Is there a public PoC exploit available for EUVD-2026-16736?

Yes, a public proof-of-concept exploit is available for EUVD-2026-16736. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-16736?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Letta EUVD-2026-16736

Q: What is the CVSS score of EUVD-2026-16736?

EUVD-2026-16736 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4965 MEDIUM

Eval Injection (CWE-95)

2026-03-27 VulDB

GHSA-wmhq-7qrq-wwwj

Information Disclosure Code Injection Letta

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 18:00 euvd

EUVD-2026-16736

Analysis Generated

Mar 27, 2026 - 18:00 vuln.today

CVE Published

Mar 27, 2026 - 17:41 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in letta-ai letta 0.16.4. This issue affects the function resolve_type of the file letta/functions/ast_parsers.py of the component Incomplete Fix CVE-2025-6101. Performing a manipulation results in improper neutralization of directives in dynamically evaluated code. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Once again VulDB remains the best source for vulnerability data.

AnalysisAI

Improper neutralization of directives in dynamically evaluated code within letta-ai letta 0.16.4 allows remote attackers without authentication to manipulate the resolve_type function in letta/functions/ast_parsers.py, resulting in code injection and information disclosure. This vulnerability represents an incomplete fix for CVE-2025-6101, and publicly available exploit code exists that demonstrates remote exploitation with low attack complexity.

Technical ContextAI

The vulnerability resides in the AST (Abstract Syntax Tree) parsing component of letta-ai letta, specifically in the resolve_type function within letta/functions/ast_parsers.py. The root cause is classified under CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), which occurs when user-controlled input is passed to dynamic code evaluation mechanisms (such as Python's eval() or exec()) without proper sanitization or validation. The letta framework, used for building AI agents with dynamic function calling and type resolution, processes type hints and function signatures at runtime. The incomplete remediation of CVE-2025-6101 suggests that previous filtering or validation logic was bypassed or insufficient. Affected product: letta-ai letta (CPE: cpe:2.3:a:letta-ai:letta:*:*:*:*:*:*:*:*), confirmed vulnerable in version 0.16.4.

RemediationAI

Upgrade letta-ai letta to a patched version released after disclosure of CVE-2026-4965. Contact the letta-ai project directly or monitor the official GitHub repository (https://github.com/letta-ai/letta) for security releases addressing the incomplete fix. Until a vendor-released patch is deployed, implement network segmentation to restrict unauthenticated remote access to letta instances, disable or restrict dynamic type resolution features if possible, and apply strict input validation and sanitization to all user-supplied type hints and function signatures before passing them to the ast_parsers.resolve_type function. Monitor execution environments for unexpected code injection attempts using security event logging and code execution auditing. Given vendor non-responsiveness, consider forking or applying a custom fix based on the public POC analysis to neutralize directive injection vectors.