MediumVulnerability
CVE-2026-11479: grepai use of weak hash in Qdrant backend chunker
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-11479
- Published
- Record updated
- Affected
- github.com/yoanbernabeu/grepai <= 0.35.0
- Fixed in
- No fixed version was stated when the source was last read.
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
A vulnerability in yoanbernabeu grepai 0.35.0 affects the processing of indexer/chunker.go in its Qdrant Backend component, leading to use of a weak hash (CWE-328). The attack may be performed remotely, but the exploitability is assessed as difficult, and the exploit has been publicly disclosed. The CVSS 4.0 base score from VulDB is rated LOW, and NIST has not yet provided an assessment.
Mitigation
The pull request to fix this issue (https://github.com/yoanbernabeu/grepai/pull/248) awaits acceptance. No fixed version is stated in the source.
Related items
- MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
- HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
- HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database
- HighCVE-2026-122133: Mistral Vibe untrusted search path code execution via git.exe on WindowsSimilar attack · NVD/CVE Database
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database