PT-2026-28103 · Plex+1 · Plex Media Server+1

Q1Uf3Ng · Published 2026-03-25 · Updated 2026-03-31 · CVE-2026-28505

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tautulli versions prior to 2.17.0

Description Tautulli is a Python-based monitoring and tracking tool for Plex Media Server. Before version 2.17.0, the str eval() function within the notification handler.py file implemented a sandboxed eval() function for notification text templates. The sandbox aimed to restrict callable names by inspecting code.co names of the compiled code object. However, code.co names only contains names from the outer code object. When a lambda expression was used, it created a nested code object, and attribute accesses were stored in code.co consts, not code.co names. Consequently, the sandbox did not inspect nested code objects.

Recommendations Update Tautulli to version 2.17.0 or later.

Exploit

Fix

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

CVE-2026-28505

GHSA-M62J-GWM9-7P8M

Affected Products

Plex Media Server

Tautulli

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28505.json · Exploit
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-m62j-gwm9-7p8m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28505 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28505 · Vendor Advisory
• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 · Note
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Twitter Post
• https://reddit.com/r/Tautulli/comments/1s5uon8/important_security_update_20260327 · Reddit Post
• https://twitter.com/infoflowcloud/status/2038918314903183623 · Twitter Post
• https://twitter.com/CVEnew/status/2038916096812896522 · Twitter Post