This vulnerability involves unsafe deserialization in the Indexer.deserialize_from function of the retrieval_lm component in AkariAsai self-rag. An attacker can manipulate the index_meta.faiss argument to cause deserialization, which may lead to remote exploitation. The product is delivered via rolling releases, and no specific affected or patched versions are available. The vendor has not yet issued a response or remediation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to perform deserialization attacks remotely, potentially leading to unauthorized code execution or other impacts depending on the deserialization context. The CVSS score of 5.3 reflects a medium severity with limited impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a fix is available, avoid processing untrusted input in the affected function if possible.