{"id":"CVE-2026-11481","aliases":["GHSA-q76h-p6jh-9rw3"],"title":"grepai Uses a Broken or Risky Cryptographic Algorithm","summary":"grepai Uses a Broken or Risky Cryptographic Algorithm","severity":"low","cvss":2.5,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","vendor":"yoanbernabeu","product":"github.com/yoanbernabeu/grepai","ecosystem":"go","affected":["github.com/yoanbernabeu/grepai <= 0.35.0"],"published":"2026-06-08","updated":"2026-07-28","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-q76h-p6jh-9rw3","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11481"},{"url":"https://github.com/yoanbernabeu/grepai/issues/249"},{"url":"https://github.com/yoanbernabeu/grepai/pull/250"},{"url":"https://github.com/yoanbernabeu/grepai"},{"url":"https://vuldb.com/cve/CVE-2026-11481"},{"url":"https://vuldb.com/submit/833997"},{"url":"https://vuldb.com/vuln/369101"},{"url":"https://vuldb.com/vuln/369101/cti"}],"tags":["osv","go"],"epss":0.00082,"epssPercentile":0.00264,"ingestedAt":"2026-07-29T19:09:37.649Z","slug":"CVE-2026-11481","body":"## Overview\n\nA vulnerability was determined in yoanbernabeu grepai up to 0.35.0. The affected element is the function PostgresStore.LookupByContentHash of the file indexer/chunker.go of the component Postgres Embedding Cache. Executing a manipulation of the argument content_hash can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.\n\n## Affected packages\n\n- `github.com/yoanbernabeu/grepai <= 0.35.0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}