CVE-2026-58449

creationtimestamp| type| source ---|---|--- 2026-06-30 22:26:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpk2bvcfe326 2026-07-02 20:45:15+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpovld6x432e...

CVE-2026-58449 txtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameter

txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body parameter is resolved through txtai.util.Resolver, which performs import and getattr on the caller-supplied dotted path with no allowlist. When the API is exposed with no TOKEN configured...