PT-2026-47197 · Zilliztech · Deep-Searcher
CVSS v2.0
5.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
zilliztech deep-searcher versions prior to 0.0.3
Description
Improper access controls in the
CollectionRouter.invoke() function within the deepsearcher/agent/collection router.py file allow for remote exploitation. This issue is caused by the manipulation of the kwargs argument, which can lead to remote code execution.Recommendations
As a temporary workaround, restrict access to the
CollectionRouter.invoke() function until a patch is available.Exploit
Fix
RCE
Incorrect Privilege Assignment
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Deep-Searcher