Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-11466 EUVD-2026-34997GHSA-43px-gpwc-q84vPYSEC-2026-3567

zilliztech deep-searcher collection_router.py CollectionRouter.invoke access control

Published Jun 7, 2026 · Updated Jun 8, 2026 · Assigned by VulDB

Description

A weakness has been identified in zilliztech deep-searcher up to 0.0.2. This affects the function CollectionRouter.invoke of the file deepsearcher/agent/collection_router.py. This manipulation of the argument kwargs causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

Affected products

VendorProductAffectedFixed
zilliztech deep-searcher 0.0.1, 0.0.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI deepsearcher <= 0.0.2 — GHSA-43px-gpwc-q84v

References