Executive brief
txtai is an all-in-one embeddings database used for semantic search and machine learning workflows. A security flaw in its web API allows an attacker to execute arbitrary commands on the server if the API is exposed without a password and configured to allow index updates. This could lead to a complete takeover of the server, theft of sensitive data, or disruption of search services.
Technical details
The txtai API's /reindex endpoint accepts a 'function' parameter that is processed by txtai.util.Resolver. This component uses __import__ and getattr on user-supplied dotted paths without an allowlist, leading to unsafe reflection. If the API is deployed without a TOKEN (authentication is opt-in) and the index is configured as writable, a remote attacker can provide a malicious path such as 'os.system' or 'subprocess.getoutput' to execute arbitrary Python code or shell commands with the privileges of the server process. The vulnerability is fixed in commit 11b32da by requiring an explicit 'reindex' configuration flag to enable the endpoint.
Affected products
- neuml txtai <= 9.10.0
Timeline
- 2026-06-09: other: Initial development work to gate the reindex parameter started
- 2026-06-26: disclosed: Security issue reported via GitHub issue #1122
- 2026-06-30: advisory
- 2026-06-30: patched: Fix commit 11b32da released