A vulnerability was found in letta-ai letta 0.16.4. It has been classified as critical. This issue affects the function
resolve_type of the file letta/functions/ast_parsers.py of the component Incomplete Fix CVE-2025-6101. Performing a manipulation results in improper neutralization of directives in dynamically evaluated code.
This vulnerability is identified as CVE-2026-4965. The attack can be initiated remotely. Additionally, an exploit exists.
The vendor was contacted early about this disclosure but did not respond in any way.
