CVE-2026-11481
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
Vulnerability in grepai up to 0.35.0. The PostgresStore.LookupByContentHash function in indexer/chunker.go (Postgres Embedding Cache component) uses a weak hash for the content_hash argument. Attack requires local access and high complexity. Exploit is publicly available.
Risk Assessment
Risk includes hash collision or data manipulation in the cache, potentially leading to application misbehavior or information leakage.
Recommendation
Monitor the pull request for a fix and apply it once accepted. Temporarily restrict local access to the system.
Original NVD description (English source)
A vulnerability was determined in yoanbernabeu grepai up to 0.35.0. The affected element is the function PostgresStore.LookupByContentHash of the file indexer/chunker.go of the component Postgres Embedding Cache. Executing a manipulation of the argument content_hash can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.