An unauthenticated remote code execution vulnerability exists in Letta 0.16.4 due to an insecure eval() fallback in type annotation processing, posing a critical risk to affected systems.

The application incorrectly utilizes an eval() fallback for processing Python type annotations when safe AST parsing fails. Because the allow_unsafe_eval flag is hardcoded to true in all sandbox execution paths, an unauthenticated attacker can inject arbitrary Python code via the POST /v1/tools/run endpoint.

Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary code on the underlying host system. This level of access typically leads to complete system compromise, unauthorized data exfiltration, and the potential for lateral movement within the network. Given the CVSS score of 7.3, this flaw represents a significant threat to operational integrity and data confidentiality.

Immediate Action: Update the Letta software to a version that properly neutralizes dynamic code evaluation and enforces secure type parsing. If a patch is unavailable, immediately restrict access to the /v1/tools/run endpoint to trusted internal networks only.

Proactive Monitoring: Monitor system logs for unusual POST requests to the /v1/tools/run endpoint, specifically looking for payloads containing Python built-in functions or suspicious type annotations. Implement alerts for any unexpected execution of shell commands originating from the Letta service process.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect JSON payloads for malicious Python syntax or attempts to invoke system-level commands within the tool submission process.

Public Exploit Available: Yes, a proof-of-concept exists as detailed in the GitHub Gist referenced by the vulnerability report.

This vulnerability is critical due to the ease of remote code execution without authentication. Organizations running Letta 0.16.4 must prioritize applying security updates as soon as the vendor provides them. Until an official patch is verified, network-level restrictions on the vulnerable API endpoint are essential to prevent unauthorized command execution.