CVE-2026-58449

creationtimestamp| type| source ---|---|--- 2026-06-30 22:26:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpk2bvcfe326 2026-07-02 20:45:15+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpovld6x432e...

ai-atlas-nexus (>=1.1.0, <=1.2.4), annotateai (>=0.1.0, <=0.3.0) +29 more potentially affected by CVE-2026-58449 via txtai (>=4.6.0, <=9.12.0)

txtai PYPI version =4.6.0, =1.1.0, =0.1.0, =0.1.1, =1.1.0, =1.0.0, =0.0.7, =0.1.0, =0.2.1, =0.1.0, =0.3.0, =0.1.1, =0.3.0 - nbx-ai 0.0.1 and more Source cves: CVE-2026-58449 Source advisory: SNYK:PYTHON-TXTAI-17751727...

CVE-2026-58449 txtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameter

txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body parameter is resolved through txtai.util.Resolver, which performs import and getattr on the caller-supplied dotted path with no allowlist. When the API is exposed with no TOKEN configured...