Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

letta-ai/letta

              main @ 1131535
            

Fixes

CVEs

CRITICAL

Peak severity

20.6%

Coverage

Highlights

Denial of Service: 32 prior fixes. Scrutinize any change in this area.

letta/server/rest_api/routers/v1/sources.py: most-fixed (6 issues). Treat as high-risk during review.

31 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Insecure evaluation of tool type annotations via arbitrary strings inside eval() allowed host-level remote code execution. This pattern is tracked as CVE-2026-4965. Developers must strictly use AST parsing and allowlists instead of raw eval.

Code Injection: Tool execution scripts were dynamically constructed using raw string interpolation for parameters, enabling attackers to inject arbitrary python commands. Raw string interpolation of arguments inside tool execution templates must be replaced with safe formats like pickle or JSON serialization.

Authorization Bypass: Organization-scoped model queries could run without validating the requesting actor context, resulting in cross-tenant data access. Developers must explicitly enforce actor ID checks and organization filters on all query builders.