CVE-2025-51482: Letta Letta RCE Vulnerability

CVE-2025-51482 Overview

CVE-2025-51482 is a Remote Code Execution vulnerability discovered in letta-ai Letta version 0.7.12. The vulnerability exists in letta.server.rest_api.routers.v1.tools.run_tool_from_source and allows remote attackers to execute arbitrary Python code and system commands via crafted payloads to the /v1/tools/run endpoint, bypassing intended sandbox restrictions. This vulnerability poses a significant threat to organizations using Letta for AI agent development and deployment.

Critical Impact

Remote attackers can achieve arbitrary code execution on systems running vulnerable Letta instances, potentially leading to complete system compromise, data exfiltration, and lateral movement within enterprise environments.

Affected Products

• letta-ai Letta version 0.7.12
• Systems exposing the Letta REST API /v1/tools/run endpoint

Discovery Timeline

• 2025-07-22 - CVE-2025-51482 published to NVD
• 2025-10-07 - Last updated in NVD database

Technical Details for CVE-2025-51482

Vulnerability Analysis

This vulnerability falls under CWE-94 (Improper Control of Generation of Code, also known as Code Injection). The flaw resides in the run_tool_from_source function within Letta's REST API router module. The endpoint is designed to execute custom tool code provided by users, but fails to properly enforce sandbox restrictions that should prevent the execution of dangerous operations.

The attack requires network access and some form of user interaction, but once exploited, it grants the attacker full control over code execution with the privileges of the Letta server process. This can result in complete confidentiality, integrity, and availability compromise of the affected system.

Root Cause

The root cause stems from inadequate validation and sandboxing of user-supplied code in the run_tool_from_source function. The intended sandbox restrictions that should prevent arbitrary Python code execution can be bypassed through specially crafted payloads. This allows attackers to break out of the restricted execution environment and execute arbitrary Python code and system commands on the underlying server.

Attack Vector

The attack is conducted over the network by sending malicious payloads to the /v1/tools/run endpoint. An attacker crafts a payload that exploits weaknesses in the sandbox implementation, allowing them to:

1. Bypass sandbox restrictions designed to limit code execution
2. Execute arbitrary Python code within the server context
3. Leverage Python's capabilities to execute system commands
4. Potentially gain persistent access or pivot to other systems

The vulnerability exploits the trust placed in the tool execution functionality, where insufficient input sanitization and sandbox escape prevention allows code injection attacks. For detailed technical analysis, refer to the Gecko Security Blog CVE Analysis.

Detection Methods for CVE-2025-51482

Indicators of Compromise

• Unusual HTTP POST requests to the /v1/tools/run endpoint with large or obfuscated payloads
• Unexpected process spawning from the Letta server process
• Network connections initiated by the Letta service to external or unusual destinations
• System command execution traces in server logs correlating with API calls

Detection Strategies

• Monitor web application firewall (WAF) logs for suspicious payloads targeting the /v1/tools/run endpoint
• Implement behavioral analysis to detect sandbox escape attempts and unusual code execution patterns
• Deploy endpoint detection and response (EDR) solutions to identify malicious process creation
• Review Letta server access logs for anomalous API request patterns

Monitoring Recommendations

• Enable detailed logging for the Letta REST API, specifically the tools router module
• Configure alerts for any system command execution originating from the Letta process
• Monitor for Python subprocess or os module usage that deviates from normal application behavior
• Implement network segmentation monitoring to detect lateral movement attempts

How to Mitigate CVE-2025-51482

Immediate Actions Required

• Upgrade Letta to a patched version as soon as available
• Restrict network access to the /v1/tools/run endpoint to trusted sources only
• Implement additional authentication and authorization controls for the tools API
• Consider disabling the run_tool_from_source functionality if not critical to operations

Patch Information

The vendor has addressed this vulnerability through GitHub Pull Request #2630. Organizations should review this pull request and apply the fix or upgrade to a version that includes this security patch. Monitor the Letta GitHub repository for official release announcements containing this fix.

Workarounds

• Place the Letta server behind a reverse proxy with strict request filtering for the /v1/tools/run endpoint
• Implement IP-based access controls to limit who can reach the vulnerable endpoint
• Deploy a web application firewall (WAF) with custom rules to detect and block code injection attempts
• Run the Letta server in a containerized environment with minimal privileges and restricted system access

# Example: Restrict access to the vulnerable endpoint using nginx
location /v1/tools/run {
    # Allow only trusted internal networks
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    # Additional rate limiting
    limit_req zone=api_limit burst=5 nodelay;
    
    proxy_pass http://letta_backend;
}