CVE-2026-11479

MediumCVSS 4.2

Published: 08/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

Vulnerability in grepai 0.35.0, affecting the Qdrant Backend component in file indexer/chunker.go. Manipulation leads to use of weak hash. The attack is remote but highly complex and difficult to exploit. The exploit has been publicly disclosed.

Risk Assessment

Potential risk from weak hash usage could allow an attacker to compromise data integrity, but requires advanced skills.

Recommendation

Wait for the pull request with the fix to be accepted or apply temporary network safeguards.

Other vulnerabilities in grepai

CVE-2026-11481Low
Vulnerability in grepai up to 0.35.0. The PostgresStore.LookupByContentHash function in indexer/chunker.go (Postgres Embedding Cache component) uses a weak hash for the content_hash argument. Attack requires local access and high complexity. Exploit is publicly available.

Original NVD description (English source)

A vulnerability has been found in yoanbernabeu grepai 0.35.0. This issue affects some unknown processing of the file indexer/chunker.go of the component Qdrant Backend. Such manipulation leads to use of weak hash. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS