CVE-2026-28505

CVE-2026-28505 affects Tautulli prior to version 2.17.0. The root cause is a flawed sandbox in notification_handler.py: the str_eval() sandbox inspects code.co_names, but nested lambda expressions create code objects whose attributes appear in code.co_consts, allowing bypass of the whitelist. Thi...