Raw vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-28505 is a high-severity Code Injection (CWE-94) vulnerability in Tautulli Tautulli. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-28505 is a critical vulnerability in Tautulli, a Python-based monitoring and tracking tool for Plex Media Server. The issue resides in the str_eval() function within notification_handler.py, which implements a sandboxed eval() for processing notification text templates. The sandbox restricts callable names by inspecting code.co_names of the compiled code object, but this only covers names from the outer code object. Lambda expressions create nested code objects where attribute accesses are stored in code.co_consts, which the sandbox does not inspect, allowing bypass of the restrictions. This affects Tautulli versions prior to 2.17.0 and is classified under CWE-94 (Code Injection) and CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), with a CVSS v3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Remote attackers without authentication can exploit this vulnerability over the network with low complexity and no user interaction. By crafting malicious notification text templates containing lambda expressions, attackers bypass the sandbox and execute arbitrary Python code on the Tautulli server. This grants high-impact confidentiality, integrity, and availability violations, including full remote code execution in a changed scope, potentially compromising the host system running Plex Media Server.
The vulnerability has been patched in Tautulli version 2.17.0, as detailed in the project's release notes and security advisory. Security practitioners should upgrade to this version or later to mitigate the issue, and review any custom notification templates for potential exploitation vectors. Relevant advisories are available at the Tautulli GitHub release page and GitHub Security Advisory GHSA-m62j-gwm9-7p8m.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17184
Vulnerability Data
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict callable names by inspecting code.co_names…
more
of the compiled code object. However, co_names only contains names from the outer code object. When a lambda expression is used, it creates a nested code object whose attribute accesses are stored in code.co_consts, NOT in code.co_names. The sandbox never inspects nested code objects. This issue has been patched in version 2.17.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.1V1.3.2
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation finds code paths that accept and execute externally influenced strings.
Input validation directly stops untrusted data from being used to construct executable code without neutralization.
Least privilege limits the damage an injected code fragment can perform once executed.
Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly target injection flaws via secure coding and testing (mostly), yet as a single broad outcome it leaves many code-generation specifics unaddressed (partial).
PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect eval injection vulnerabilities before deployment.
Secure development life cycle mandates input validation and safe coding practices that directly prevent eval injection.
Application security requirements include rules against dynamic code execution of untrusted input.
Secure architecture principles discourage unsafe dynamic evaluation constructs.
Banning unapproved code samples and unauthenticated web services, combined with secure-coding standards and SAST, prevents the dynamic generation or inclusion of attacker-supplied code.
Separation of environments limits the blast radius if eval injection occurs in non-production.