CVE-2026-18852
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a, impacting the function SplitTokens/ShuntingYard in the file engine/query/expr/expr.cpp of the Filter Parser component. Such manipulation leads to improper check for unusual conditions. The attack needs to be performed locally, and the exploit has been disclosed publicly.
Risk Assessment
A local attacker could exploit the improper condition check to cause unexpected behavior, potentially leading to crashes or unauthorized data access.
Recommendation
Upgrade epsilla-cloud vectordb to a version newer than 0.3.18 if available, and restrict local access. Monitor public disclosures.
Original NVD description (English source)
A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.cpp of the component Filter Parser. Such manipulation leads to improper check for unusual conditions. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.