CVE-2026-11466

Name of the Vulnerable Software and Affected Versions zilliztech deep-searcher versions prior to 0.0.3

Description Improper access controls in the CollectionRouter.invoke() function within the deepsearcher/agent/collection router.py file allow for remote exploitation. This issue is caused by the manipulation of the kwargs argument, which can lead to remote code execution.

Recommendations As a temporary workaround, restrict access to the CollectionRouter.invoke() function until a patch is available.