Description
letta-ai Letta0.7.12中的letta.server.rest_api.routers.v1.tools.run_tool_from_source存在远程代码执行漏洞，允许远程攻击者通过向/v1/tools/run端点发送恶意负载来执行任意Python代码和系统命令，从而绕过预期的沙箱限制。
Letta平台AI代理框架存在代码执行漏洞（CVE-2025-51482）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-51482
https://www.gecko.security/blog/cve-2025-51482
https://cloud.tencent.com/developer/article/2599666
https://github.com/advisories/GHSA-2pgv-8585-494w
https://security.snyk.io/vuln/SNYK-PYTHON-LETTA-11023292
https://blog.csdn.net/nnn2188185/article/details/149815768
https://www.sentinelone.com/vulnerability-database/cve-2025-51482/
https://mdr.skyeye.qianxin.com/forum/article/780
https://zhuanlan.zhihu.com/p/1982132661897144073