CVE-2026-18852
Full vulnerability record from the local CVENow database.
Description
A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.cpp of the component Filter Parser. Such manipulation leads to improper check for unusual conditions. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
LOW
CVSS score
1.9
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-08-05 00:16:59.370000
Last modified
2026-10-23 21:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-18852",
"sourceIdentifier": "[email protected]",
"published": "2026-08-05T00:16:59.370",
"lastModified": "2026-10-23T21:10:00.157",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.cpp of the component Filter Parser. Such manipulation leads to improper check for unusual conditions. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "es",
"value": "Una vulnerabilidad ha sido encontrada en epsilla-cloud vectordb hasta 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. Esto afecta la función SplitTokens/ShuntingYard del archivo engine/query/expr/expr.cpp del componente Filter Parser. Dicha manipulación conduce a una comprobación incorrecta para condiciones inusuales. El ataque necesita ser realizado localmente. El exploit ha sido divulgado al público y puede ser utilizado. El proveedor fue contactado tempranamente sobre esta divulgación pero no respondió de ninguna manera."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "epsilla-cloud",
"product": "vectordb",
"cpes": [
"cpe:2.3:a:epsilla-cloud:vectordb:*:*:*:*:*:*:*:*"
],
"modules": [
"Filter Parser"
],
"versions": [
{
"version": "0.3.0",
"status": "affected"
},
{
"version": "0.3.1",
"status": "affected"
},
{
"version": "0.3.2",
"status": "affected"
},
{
"version": "0.3.3",
"status": "affected"
},
{
"version": "0.3.4",
"status": "affected"
},
{
"version": "0.3.5",
"status": "affected"
},
{
"version": "0.3.6",
"status": "affected"
},
{
"version": "0.3.7",
"status": "affected"
},
{
"version": "0.3.8",
"status": "affected"
},
{
"version": "0.3.9",
"status": "affected"
},
{
"version": "0.3.10",
"status": "affected"
},
{
"version": "0.3.11",
"status": "affected"
},
{
"version": "0.3.12",
"status": "affected"
},
{
"version": "0.3.13",
"status": "affected"
},
{
"version": "0.3.14",
"status": "affected"
},
{
"version": "0.3.15",
"status": "affected"
},
{
"version": "0.3.16",
"status": "affected"
},
{
"version": "0.3.17",
"status": "affected"
},
{
"version": "0.3.18",
"status": "affected"
},
{
"version": "df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 1.9,
"baseSeverity": "LOW",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 3.3,
"baseSeverity": "LOW",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.8,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P",
"baseScore": 1.7,
"accessVector": "LOCAL",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "LOW",
"exploitabilityScore": 3.1,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-05T13:17:52.467668Z",
"id": "CVE-2026-18852",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-754"
}
]
}
],
"references": [
{
"url": "https://github.com/fa1c4/security-advisories/tree/main/VectorDB",
"source": "[email protected]"
},
{
"url": "https://github.com/fa1c4/security-advisories/tree/main/VectorDB/PoC",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-18852",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/858196",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/385857",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/385857/cti",
"source": "[email protected]"
}
]
}