A flaw was identified in the _deduplicate_results function of the InsightEngine component in 666ghj BettaFish. The bug allows an attacker to manipulate the deduplication process through partial string comparison. Because the comparison logic is performed on user‑supplied data, an attacker can craft input that bypasses intended checks, potentially leading to unauthorized access or data corruption. The weakness maps to CWE‑187 (Partial Comparison) and CWE‑697 (Incorrect Verification of Cryptographic Signature).

The vulnerability affects all installations of BettaFish up to version 1.2.1. The component in question is the InsightEngine search‑result Deduplication module located in the agent.py file. 666ghj, the vendor responsible for BettaFish, has not released an affected‑version list beyond the stated upper bound.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is available, so the current likelihood of exploitation is unknown, and the entry is not listed in the CISA KEV catalog. The description states that the attack can be launched remotely and that the exploit has been publicly disclosed, suggesting that an attacker can reach the vulnerable function from an external network if the InsightEngine component is exposed. The exploitation path relies on sending specially crafted strings that trigger the insecure comparison logic; once the function behaves anomalously, the attacker can influence downstream processing or bypass deduplication safeguards. The lack of a publicly available patch at this time raises the urgency for administrators to monitor for related activity and to apply mitigation measures promptly.