CVE-2026-31231 describes a critical remote code execution vulnerability in Cognee through version 0.4.0. The vulnerability exists in the notebook cell execution API endpoint, which uses Python's exec() function unsafely to run user-supplied code without any sandboxing or security controls. This allows an unauthenticated attacker to send specially crafted POST requests containing malicious Python code, resulting in arbitrary code execution on the server with the privileges of the server process. The CVSS v3.1 base score is 9.8, reflecting the high impact and ease of exploitation. There is no vendor advisory or patch available at this time.

Successful exploitation allows an attacker to execute arbitrary Python code on the Cognee server remotely without authentication. This can lead to complete system compromise, including data theft, service disruption, or further network penetration. The vulnerability is critical due to the lack of access controls and the use of unsafe code execution methods.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable API endpoint, implement network-level controls to limit exposure, and avoid deploying Cognee in untrusted environments. Monitor for any updates from the vendor regarding patches or official mitigations.