CVE-2026-69098: Cinnamon Kotaemon

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with application process privileges.

Affected products

• Cinnamon Kotaemon: up to and including 0.12.0

Published 2026-08-04. Last modified 2026-09-23.