An unauthenticated remote code execution vulnerability in Cinnamon kotaemon allows attackers to execute arbitrary commands by exploiting insecure deserialization in the check_connection endpoint.

The vulnerability stems from insecure deserialization of YAML or JSON input in the check_connection endpoint. An unauthenticated attacker can supply a crafted input containing a type field, which is used to instantiate arbitrary Python classes, leading to remote code execution with the privileges of the application process.

With a CVSS score of 9.8, this vulnerability poses a severe threat to the confidentiality, integrity, and availability of the host system. An attacker could gain full control over the server, leading to unauthorized data access, lateral movement within the network, or complete system takeover.

Immediate Action: Update Cinnamon kotaemon to the latest version as soon as a patch is released, or review the vendor security advisory for specific mitigation instructions.

Proactive Monitoring: Monitor server processes for unexpected child process spawning or anomalous network connections originating from the kotaemon application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block suspicious JSON or YAML payloads containing object instantiation directives.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing kotaemon must treat this as a high-priority security event. If an immediate update is not available, isolate the application from any untrusted network traffic and restrict access to the affected endpoint until a secure version is deployed.