Executive brief
AkariAsai self-rag is an open-source framework used to improve the accuracy of Large Language Models (LLMs) through a process called Retrieval-Augmented Generation. A security flaw allows an attacker to execute malicious code on the system running the software if they can provide a specially crafted index file. This could lead to a full system takeover, theft of API keys, or unauthorized access to sensitive data used by the AI model.
Technical details
A deserialization vulnerability exists in the `Indexer.deserialize_from` function within `retrieval_lm/src/index.py`. The application uses the Python `pickle` module to load `index_meta.faiss` files without prior validation. An attacker who can influence the contents of the retriever index cache directory—for example, by providing a malicious artifact or polluting shared storage—can achieve arbitrary code execution with the privileges of the running process. The vulnerability is triggered when the `--save_or_load_index` flag is enabled. While a pull request (#106) has been proposed to switch to JSON serialization, the project operates on a rolling release and has not yet officially merged a fix.
Affected products
- AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99
Timeline
- 2026-06-10: disclosed: Issue reported to the maintainer via GitHub issue #105 and PR #106
- 2026-07-13: advisory: CVE-2026-15535 published via VulDB/NVD