Code Injection Vulnerability in letta-ai letta Software
CVE-2025-6101

5.1MEDIUM

Key Information:

Vendor

Letta-ai

Status
Letta
Vendor
CVE Published:
16 June 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-6101?

A code injection vulnerability has been identified in the letta-ai letta software up to version 0.4.1, specifically in the function_message method of interface.py. This flaw arises due to improper handling of parameters within dynamically evaluated code, specifically the function_name and function_args arguments. Attackers can exploit this vulnerability to execute arbitrary code, which poses significant security risks for users of the affected version. It is crucial for users to take immediate action to secure their installations.

Affected Version(s)

letta 0.4.0

letta 0.4.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-6101 - Proof of Concept

References

https://vuldb.com/?id.312570
vdb-entrytechnical-description
https://vuldb.com/?ctiid.312570
signaturepermissions-required
https://vuldb.com/?submit.590528
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

ybdesire (VulDB User)
JSON
.