Executive brief
Cognee, a memory management framework for AI agents, contains a critical security flaw in its notebook execution feature. This vulnerability allows an attacker to remotely run any command or malicious code on the server hosting the application. Successful exploitation could lead to a total system takeover, theft of sensitive AI data, or disruption of services.
Technical details
Cognee through version 0.4.0 is vulnerable to remote code execution (RCE) via its notebook cell execution API endpoint. The root cause is the use of the unsafe Python exec() function to process user-supplied code without any sandboxing, input validation, or security controls. An unauthenticated attacker can exploit this by sending a specially crafted POST request containing malicious Python payloads to the affected endpoint. This results in arbitrary code execution with the privileges of the Cognee server process, potentially leading to full system compromise. The vulnerability is present in all versions up to and including 0.4.0.
Affected products
- topoteretes Cognee up to and including 0.4.0
Timeline
- 2026-05-12: disclosed: Initial vulnerability disclosure and NVD publication