PatchSiren

Cinnamon CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL Cinnamon CVE published 2026-08-04

CVE-2026-69098

The kotaemon library through version 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint. This vulnerability allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remot [truncated]