CVE-2026-4965 is a high severity (CVSS 7.3) code injection in letta-ai Letta 0.16.4. The resolve_type function in ast_parsers.py is an incomplete fix for CVE-2025-6101 and can evaluate crafted input. No fixed version is named, so check the project and limit who can supply tool definitions.
What's affected
- Product: letta-ai Letta, version 0.16.4 per the record.
- Component: the
resolve_typefunction inletta/functions/ast_parsers.py. - Fixed version: none stated in the record. The record says the vendor was contacted and did not respond. Check the project's releases.
- Weaknesses: CWE-94, code injection, and CWE-95, eval injection.
- CVSS 7.3 (high), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. - Published 27 March 2026. Not marked as exploited in CISA KEV. The record says a public write-up exists.
How to check if you're exposed
Check your version and who can reach the server.
pip show letta | grep -i '^version'
docker ps --format '{.Image}' | grep -i letta
Then check who can create or edit custom tools or functions, since the weakness is in code that parses function definitions. If the server is reachable without a login from untrusted networks, that is the first thing to change.
What to do now
- Check the Letta releases for a fix newer than 0.16.4, and upgrade when one exists.
- Require authentication on the server and keep it off the public internet.
- Limit who can add or change tools and functions.
- Run the server as a low privilege user in a container without secrets beyond what it needs.
- Review stored tool definitions for anything you did not write.
Why it matters
Agent platforms accept code or type descriptions from users and parse them. If the parser evaluates a piece of that text, the text can run as code. The record places this in CWE-94 and CWE-95, and calls it an incomplete fix, meaning an earlier report on the same area was patched but not completely.
When a fix for a class of bug is narrow, the same root cause tends to come back. The durable answer is to stop evaluating input and to parse it with a safe parser that only accepts the shapes you expect.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs.
Quick check
What does incomplete fix mean here?
The record says this issue sits in code that was changed for CVE-2025-6101 and still has a way through.
Sources
- Researcher write-up (named in the record; not fetched)
- VulDB entry
- Safeguard Gold entry
Last reviewed: 19 October 2026.
