CVE-2026-18852

A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.cpp of the component Filter Parser. Such manipulation leads to improper check for unusual conditions. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS v3 3.3 LOW
CVSS v2.0 1.7 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

1.7^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 3.1 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/fa1c4/security-advisories/tree/main/VectorDB
https://github.com/fa1c4/security-advisories/tree/main/VectorDB/PoC
https://vuldb.com/cve/CVE-2026-18852
https://vuldb.com/submit/858196
https://vuldb.com/vuln/385857
https://vuldb.com/vuln/385857/cti

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad ha sido encontrada en epsilla-cloud vectordb hasta 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. Esto afecta la función SplitTokens/ShuntingYard del archivo engine/query/expr/expr.cpp del componente Filter Parser. Dicha manipulación conduce a una comprobación incorrecta para condiciones inusuales. El ataque necesita ser realizado localmente. El exploit ha sido divulgado al público y puede ser utilizado. El proveedor fue contactado tempranamente sobre esta divulgación pero no respondió de ninguna manera.

Information

Published : 2026-08-05 00:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-18852

Mitre link : CVE-2026-18852

CVE.ORG link : CVE-2026-18852

JSON object : View

Products Affected

No product.

CWE

CWE-754

Improper Check for Unusual or Exceptional Conditions

{"id": "CVE-2026-18852", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18852", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T13:17:52.467668Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 1.7, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:epsilla-cloud:vectordb:*:*:*:*:*:*:*:*"], "vendor": "epsilla-cloud", "modules": ["Filter Parser"], "product": "vectordb", "versions": [{"status": "affected", "version": "0.3.0"}, {"status": "affected", "version": "0.3.1"}, {"status": "affected", "version": "0.3.2"}, {"status": "affected", "version": "0.3.3"}, {"status": "affected", "version": "0.3.4"}, {"status": "affected", "version": "0.3.5"}, {"status": "affected", "version": "0.3.6"}, {"status": "affected", "version": "0.3.7"}, {"status": "affected", "version": "0.3.8"}, {"status": "affected", "version": "0.3.9"}, {"status": "affected", "version": "0.3.10"}, {"status": "affected", "version": "0.3.11"}, {"status": "affected", "version": "0.3.12"}, {"status": "affected", "version": "0.3.13"}, {"status": "affected", "version": "0.3.14"}, {"status": "affected", "version": "0.3.15"}, {"status": "affected", "version": "0.3.16"}, {"status": "affected", "version": "0.3.17"}, {"status": "affected", "version": "0.3.18"}, {"status": "affected", "version": "df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a"}]}]}], "published": "2026-08-05T00:16:59.370", "references": [{"url": "https://github.com/fa1c4/security-advisories/tree/main/VectorDB", "source": "cna@vuldb.com"}, {"url": "https://github.com/fa1c4/security-advisories/tree/main/VectorDB/PoC", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-18852", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/858196", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/385857", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/385857/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-754"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.cpp of the component Filter Parser. Such manipulation leads to improper check for unusual conditions. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en epsilla-cloud vectordb hasta 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. Esto afecta la funci\u00f3n SplitTokens/ShuntingYard del archivo engine/query/expr/expr.cpp del componente Filter Parser. Dicha manipulaci\u00f3n conduce a una comprobaci\u00f3n incorrecta para condiciones inusuales. El ataque necesita ser realizado localmente. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "cna@vuldb.com"}