letta 0.1.4 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the letta package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Directory Traversal letta is a Create LLM agents with long-term memory and custom tools Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization in the file upload functionality. An attacker can upload and overwrite files outside the intended directory by providing specially crafted file names. How to fix Directory Traversal? Upgrade `letta` to version 0.6.8 or higher.	[,0.6.8)
C Arbitrary Code Injection letta is a Create LLM agents with long-term memory and custom tools Affected versions of this package are vulnerable to Arbitrary Code Injection via the `run_local_dir_sandbox_directly` function in the `tool_execution_sandbox.py` file. An attacker can execute arbitrary Python code and system commands by sending specially crafted payloads to the `/v1/tools/run` endpoint, bypassing intended sandbox restrictions. How to fix Arbitrary Code Injection? A fix was pushed into the `master` branch but not yet published.	[0,)
M Eval Injection letta is a Create LLM agents with long-term memory and custom tools Affected versions of this package are vulnerable to Eval Injection via the `function_message` process. An attacker can execute arbitrary code by manipulating the `function_name` or `function_args` arguments. How to fix Eval Injection? There is no fixed version for `letta`.	[0,)
M Missing Authorization letta is a Create LLM agents with long-term memory and custom tools Affected versions of this package are vulnerable to Missing Authorization on the `/users` endpoint, which does not check for authorization before returning data from the `get_all_users()` function. How to fix Missing Authorization? Upgrade `letta` to version 0.5.2 or higher.	[,0.5.2)

Vulnerability

Vulnerable Version

Directory Traversal

letta is a Create LLM agents with long-term memory and custom tools

Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization in the file upload functionality. An attacker can upload and overwrite files outside the intended directory by providing specially crafted file names.

How to fix Directory Traversal?

Upgrade letta to version 0.6.8 or higher.

[,0.6.8)

Arbitrary Code Injection

letta is a Create LLM agents with long-term memory and custom tools

Affected versions of this package are vulnerable to Arbitrary Code Injection via the run_local_dir_sandbox_directly function in the tool_execution_sandbox.py file. An attacker can execute arbitrary Python code and system commands by sending specially crafted payloads to the /v1/tools/run endpoint, bypassing intended sandbox restrictions.

How to fix Arbitrary Code Injection?

A fix was pushed into the master branch but not yet published.

[0,)

Eval Injection

letta is a Create LLM agents with long-term memory and custom tools

Affected versions of this package are vulnerable to Eval Injection via the function_message process. An attacker can execute arbitrary code by manipulating the function_name or function_args arguments.

How to fix Eval Injection?

There is no fixed version for letta.

[0,)

Missing Authorization

letta is a Create LLM agents with long-term memory and custom tools

Affected versions of this package are vulnerable to Missing Authorization on the /users endpoint, which does not check for authorization before returning data from the get_all_users() function.

How to fix Missing Authorization?

Upgrade letta to version 0.5.2 or higher.

[,0.5.2)

letta@0.1.4 vulnerabilities

Create LLM agents with long-term memory and custom tools

latest version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically