CVE-2026-11481

Aliases:GHSA-q76h-p6jh-9rw3GO-2026-6128
Advisory lineage Upstream: 0 Downstream: 1
Deferred
Published: 08 Jun 2026, 02:45
Last modified:08 Jun 2026, 13:01

Vulnerability Summary

Overall Risk (default)
low
20/100
CVSS Score
2.5 LOW
v3.1 (cve.org)
EPSS Score
0.08% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

08 Jun 2026, 02:45
Published
Vulnerability first disclosed
08 Jun 2026, 13:01
Last Modified
Vulnerability information updated

Description

A vulnerability was determined in yoanbernabeu grepai up to 0.35.0. The affected element is the function PostgresStore.LookupByContentHash of the file indexer/chunker.go of the component Postgres Embedding Cache. Executing a manipulation of the argument content_hash can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

CVSS Metrics

  • v4.0•LOW•Score: 2CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
  • v4.0•LOW•Score: 1.1CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•LOW•Score: 2.5CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
  • v3.1•LOW•Score: 2.5CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
  • v3.0•LOW•Score: 2.5CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
  • v2.0•LOW•Score: 1AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR
  • v2.0•LOW•Score: 1AV:L/AC:H/Au:S/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.08%• Percentile: 0%

Techniques & Countermeasures

  • CWE-327•Use of a Broken or Risky Cryptographic Algorithm

    The product uses a broken or risky cryptographic algorithm or protocol.

  • CWE-328•Use of Weak Hash

    The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

Affected Systems

  • github.com/yoanbernabeu•grepai

    ≤ 0.35.0 | all

  • yoanbernabeu•grepai

    0.1 | 0.2 | 0.3 | 0.4 | 0.5 | 0.6 | 0.7 | 0.8 | 0.9 | 0.10 | 0.11 | 0.12 | 0.13 | 0.14 | 0.15 | 0.16 | 0.17 | 0.18 | 0.19 | 0.20 | 0.21 | 0.22 | 0.23 | 0.24 | 0.25 | 0.26 | 0.27 | 0.28 | 0.29 | 0.30 | 0.31 | 0.32 | 0.33 | 0.34 | 0.35.0

References (10)