Vulnerability · Published Mar 30, 2026 · Assigned by GitHub_M

CVE-2026-28505Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check

High 7.5

In plain English

A high-severity code injection in Tautulli from Tautulli. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 4.0)7.5High

Exploit odds (30 days)0.5%top 57.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict callable names by inspecting code.co_names of the compiled code object. However, co_names only contains names from the outer code object. When a lambda expression is used, it creates a nested code object whose attribute accesses are stored in code.co_consts, NOT in code.co_names. The sandbox never inspects nested code objects. This issue has been patched in version 2.17.0.

Affected products (as reported)

Vendor	Product	Versions
Tautulli	Tautulli	< 2.17.0

Weakness: CWE-94, CWE-95 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/Tautulli/Tautulli/security/advisories/GHSA-m62j-gwm9-7p8m x_refsource_CONFIRM
https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 x_refsource_MISC