CVE-2026-28505: Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the streval() function in notificationhandler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict callable names by inspecting code.conames of the compiled code object. However, conames only contains names from the outer code object. When a lambda expression is used, it creates a nested code object whose attribute accesses are stored in code.coconsts, NOT in code.conames. The sandbox never inspects nested code objects. This issue has been patched in version 2.17.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28505?
CVE-2026-28505 has a high severity rating due to the potential for remote code execution via a sandbox bypass.
How do I fix CVE-2026-28505?
To fix CVE-2026-28505, upgrade Tautulli to version 2.17.0 or later.
What software is affected by CVE-2026-28505?
CVE-2026-28505 affects Tautulli versions prior to 2.17.0.
What kind of exploitation is possible with CVE-2026-28505?
CVE-2026-28505 allows for remote code execution by bypassing the str_eval() sandbox.
Who is the vendor for CVE-2026-28505?
The vendor for CVE-2026-28505 is Tautulli, which develops a monitoring and tracking tool for Plex Media Server.