CVE-2025-51482

HighPublic PoCRCE

Published: 22 July 2025

Published

22 July 2025

Modified

07 October 2025

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.1200 93.9th percentile

Risk Priority 25 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-51482 is a high-severity Code Injection (CWE-94) vulnerability in Letta Letta. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Supply Chain and Deployment risk domain.

The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-51482 is a remote code execution vulnerability in the letta.server.rest_api.routers.v1.tools.run_tool_from_source component of letta-ai Letta version 0.7.12. It affects the /v1/tools/run endpoint and stems from insufficient enforcement of sandbox restrictions, allowing crafted inputs to reach arbitrary Python execution paths classified under CWE-94.

Remote attackers can exploit the flaw over the network without authentication or user interaction by submitting malicious payloads to the endpoint. Successful exploitation grants the ability to run arbitrary Python code and system commands, resulting in full confidentiality, integrity, and availability impact as reflected in the CVSS 8.8 score.

The provided references point to the Letta GitHub repository, a pull request, and an analysis from Gecko Security, but contain no explicit mitigation statements in the supplied data. The EPSS score remains flat at 0.12 with no material increase after disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-22345

Vulnerability details

Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows remote attackers to execute arbitrary Python code and system commands via crafted payloads to the /v1/tools/run endpoint, bypassing intended sandbox restrictions.

CWE(s): CWE-94

AI Security AnalysisAI

AI Category: AI Agent Protocols and Integrations
Risk Domain: Supply Chain and Deployment
OWASP Top 10 for LLMs 2025: None mapped
Classification Reason: Matched keywords: ai

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability enables remote code execution via exploitation of a public-facing REST API endpoint (/v1/tools/run), allowing arbitrary Python code and system command execution by bypassing inadequate sandbox restrictions.