CVE-2026-11479

Aliases:GHSA-6h35-9p2w-3j3rGO-2026-6125
Advisory lineage Upstream: 0 Downstream: 1
Deferred
Published: 08 Jun 2026, 02:15
Last modified:09 Jun 2026, 14:46

Vulnerability Summary

Overall Risk (default)
medium
27/100
CVSS Score
4.2 MEDIUM
v3.1 (cve.org)
EPSS Score
0.16% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

08 Jun 2026, 02:15
Published
Vulnerability first disclosed
09 Jun 2026, 14:46
Last Modified
Vulnerability information updated

Description

A vulnerability has been found in yoanbernabeu grepai 0.35.0. This issue affects some unknown processing of the file indexer/chunker.go of the component Qdrant Backend. Such manipulation leads to use of weak hash. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

CVSS Metrics

  • v4.0•LOW•Score: 2.3CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
  • v4.0•LOW•Score: 1.3CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•MEDIUM•Score: 4.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
  • v3.1•MEDIUM•Score: 4.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
  • v3.0•MEDIUM•Score: 4.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
  • v2.0•LOW•Score: 3.6AV:N/AC:H/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR
  • v2.0•LOW•Score: 3.6AV:N/AC:H/Au:S/C:N/I:P/A:P

EPSS Trends

Current EPSS score: 0.16%• Percentile: 6%

Techniques & Countermeasures

  • CWE-327•Use of a Broken or Risky Cryptographic Algorithm

    The product uses a broken or risky cryptographic algorithm or protocol.

  • CWE-328•Use of Weak Hash

    The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

Affected Systems

  • github.com/yoanbernabeu•grepai

    ≤ 0.35.0 | all

  • yoanbernabeu•grepai

    0.35.0

References (10)