A security vulnerability has been detected in letta-ai letta 0.16.4.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 27, 2026 · NIST NVD

   Detected

   A security vulnerability has been detected in letta-ai letta 0.16.4. This vulnerability affects the function _convert_message_create_to_message of the file letta/helpers/message_helper.py of the component File URL Handler. Such manipulation of the argument ImageContent leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and ma

2. Jun 17, 2026 · NIST NVD

   Updated

   A security vulnerability has been detected in letta-ai letta 0.16.4. This vulnerability affects the function _convert_message_create_to_message of the file letta/helpers/message_helper.py of the component File URL Handler. Such manipulation of the argument ImageContent leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and ma

Affected

• cpe letta/letta0.16.4

Sources

• CVE.orgVulnerability recordCVE-2026-4964

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-4964

  A security vulnerability has been detected in letta-ai letta 0.16.4. This vulnerability affects the function _convert_message_create_to_message of the file letta/helpers/message_helper.py of the component File URL Handler. Such manipulation of the argument ImageContent leads to s

  nvd.nist.gov

References

• Exploit · gist.github.com
• Permissions Required · vuldb.com
• Third Party Advisory · vuldb.com
• Exploit · vuldb.com