CVE-2026-28505

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the streval() function in notificationhandler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict callable names by inspecting code.conames of the compiled code object. However, conames only contains names from the outer code object. When a lambda expression is used, it creates a nested code object whose attribute accesses are stored in code.coconsts, NOT in code.conames. The sandbox never inspects nested code objects. This issue has been patched in version 2.17.0.