CVE-2026-28505: high-severity vulnerability in Tautulli
Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.5%
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict callable names by inspecting code.co_names of the compiled code object. However, co_names only contains names from the outer code object. When a lambda expression is used, it creates a nested code object whose attribute accesses are stored in code.co_consts, NOT in code.co_names. The sandbox never inspects nested code objects. This issue has been patched in version 2.17.0.
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Tautulli · TautulliRelated CVEs — Tautulli
In the same product, most dangerous first.
CVE-2026-31831HIGHTautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpointEPSS 2.0%CVE-2025-58763HIGHTautulli vulnerable to Authenticated Remote Code Execution via Command InjectionEPSS 1.7%CVE-2025-58762CRITICALTautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agentEPSS 0.8%CVE-2025-58761HIGHTautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`EPSS 0.7%CVE-2025-58760HIGHTautulli vulnerable to Unauthenticated Path Traversal in `/image` endpointEPSS 0.6%CVE-2026-49995MEDIUMTautulli: Stored Cross-Site Scripting (XSS) in the newsletterEPSS 0.6%