The vulnerability in letta-ai letta 0.16.4 stems from an incomplete fix that allows improper neutralization of directives in dynamically evaluated code within the resolve_type function of letta/functions/ast_parsers.py. This flaw provides an attacker, who can control the input remotely, the ability to inject arbitrary code that is subsequently executed by the application. The weakness is a classic execution of arbitrary code and improper input validation, reflected in CWEs 94 and 95. Payloads exploiting this vulnerability could compromise the confidentiality and integrity of the system’s data and could also impact availability if the injected code is destructive.

Affected vendor and product: letta-ai letta version 0.16.4. No other product versions are listed as impacted in the advisory. Users running this specific version should treat the installation as vulnerable.

The CVSS score of 6.9 indicates a moderate severity, with the potential for full remote code execution. The exploit is reported as publicly available, with no indication of a solution in the CISA KEV catalog. Attackers can initiate the exploit over the network, but the exact prerequisites are not detailed in the advisory. Without a public patch, the risk remains significant for any exposed instance of the affected version.