EUVD-2026-43280
GHSA-xp65-m377-m42w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable deserialization requiring low-privilege file supply access; impact limited to process-level confidentiality, integrity, and availability with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99. Affected by this issue is the function Indexer.deserialize_from of the file retrieval_lm/src/index.py of the component retrieval_lm. Executing a manipulation of the argument index_meta.faiss can lead to deserialization. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Unsafe deserialization in AkariAsai self-rag's Indexer.deserialize_from function exposes any deployment that processes externally supplied FAISS index files to potential arbitrary code execution. The vulnerability resides in retrieval_lm/src/index.py and is triggered when the index_meta.faiss argument is manipulated with a crafted payload - a classic CWE-502 pattern where Python's serialization routines (typically pickle) blindly instantiate attacker-controlled objects. A publicly available proof-of-concept exists per GitHub issue #105, elevating the practical risk beyond the moderate CVSS 4.0 score of 5.3. No active exploitation has been confirmed by CISA KEV, and the project maintainer had not formally responded to the disclosure at time of reporting.
Technical ContextAI
self-rag (Self-Reflective Retrieval-Augmented Generation) is a research-oriented Python framework by AkariAsai that integrates FAISS (Facebook AI Similarity Search) vector indices for document retrieval in LLM pipelines. The affected component, retrieval_lm/src/index.py, implements an Indexer class whose deserialize_from method loads a serialized index bundle. FAISS indices are commonly persisted alongside Python pickle-serialized metadata; when a .faiss index file is loaded without validation, any embedded pickle payload is executed by the Python runtime during deserialization. CWE-502 (Deserialization of Untrusted Data) identifies this root cause: the application trusts the structure and content of the index_meta.faiss file without safe-load guards, allowing an attacker who can supply that file to inject executable Python objects. The CPE cpe:2.3:a:akariasai:self-rag:*:*:*:*:*:*:*:* applies to all commits up to and including 1fcdc420e48f50a7d7ab1ece5494221b93252e99.
RemediationAI
The primary fix is to apply the upstream patch submitted in GitHub pull request #106 (https://github.com/AkariAsai/self-rag/pull/106); however, as the project maintainer had not responded at time of disclosure, this PR's merge status must be independently verified before relying on it. Consumers of the codebase should manually review retrieval_lm/src/index.py and replace any pickle.load or equivalent unsafe deserialization call in Indexer.deserialize_from with a safe alternative such as pickle.loads wrapped with strict type checking, or replace pickle-based FAISS metadata serialization with JSON or another safe format. As a compensating control, restrict filesystem and network paths from which index_meta.faiss files can be loaded to sources under administrator control - do not allow user-supplied index file paths without validation. Environments running self-rag as a shared service should also enforce strict authentication and authorization on any endpoint that accepts or processes index files, reducing the PR:L attack surface. The VulDB advisory at https://vuldb.com/vuln/377885 and https://vuldb.com/cve/CVE-2026-15535 should be monitored for updates as the project responds.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today