CVE-2025-51482 is a critical Remote Code Execution (RCE) vulnerability affecting letta-ai Letta version 0.7.12. This flaw allows unauthenticated attackers to execute arbitrary Python code and system commands by sending crafted payloads to the /v1/tools/run endpoint, effectively bypassing sandbox restrictions. Rated with a CVSS score of 8.8 (HIGH), the vulnerability has a network attack vector and low attack complexity, enabling full compromise of confidentiality, integrity, and availability. Its EPSS score indicates a higher-than-average likelihood of exploitation compared to other CVEs. While not currently listed in CISA's KEV catalog, exploit intelligence shows the existence of Nuclei templates for this RCE. The vulnerability has garnered significant community discussion with 17 mentions, suggesting active interest and potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.7.12CPE matchmatch criteria | cpe:2.3:a:letta:letta:0.7.12:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.