A critical remote code execution vulnerability in Letta 0.7.12 allows attackers to bypass sandbox restrictions and execute arbitrary commands, posing a severe risk to system integrity.

This vulnerability is an improper input validation flaw located in the letta.server.rest_api.routers.v1.tools.run_tool_from_source function. Attackers can reach the /v1/tools/run endpoint to inject crafted payloads that bypass sandbox restrictions and achieve remote code execution.

The ability for an unauthenticated remote attacker to execute arbitrary system commands constitutes a complete compromise of the affected host. Given the CVSS score of 8.8, this vulnerability carries a high risk of unauthorized data exfiltration, lateral movement within the network, and potential service disruption. Organizations relying on Letta for automated tool execution should prioritize immediate remediation to prevent total system takeover.

Immediate Action: Upgrade Letta to the latest available version that includes the fix for this vulnerability, as referenced in the vendor pull request.

Proactive Monitoring: Monitor server logs for suspicious requests to the /v1/tools/run endpoint, particularly those containing encoded Python or shell commands.

Compensating Controls: Implement strict network ingress filtering to restrict access to the Letta REST API to trusted IP addresses only, and deploy a WAF to block malformed requests targeting the tool execution endpoint.

Public Exploit Available: No (a Nuclei detection template exists, but there is no evidence of a weaponized exploit or public proof-of-concept repository).

This vulnerability represents a significant security exposure due to the potential for full remote command execution. Administrators must verify their current deployment version and apply the vendor-provided security patches immediately. Until patching is completed, ensure that the API endpoint is not exposed to the public internet to reduce the attack surface.