AI Agent Automation CVE-2026-54520

Requires an authenticated account with permission to create or modify workflow file steps in AI Agent Automation prior to 0.9.1; the attacker supplies traversal segments (e.g. '../') in the step.path field of a file step. Exploitation is limited by: authentication (PR:L, not anonymous), the need for workflow-editing capability, and the backend process's own filesystem permissions (arbitrary write/overwrite only reaches files the Node process can access). No user interaction and no non-default configuration are needed - the vulnerable executeStep path is the default behavior in affected versions.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, with high confidentiality and integrity impact. The commit diff (f49ec7e8) confirms the root cause precisely: step.path was fed to path.resolve(process.cwd(), ...) with no boundary check, and the fix adds an explicit allowlist (resolveWorkflowFilePath) confining paths under runtime/workflow-files. No EPSS score, CISA KEV listing, or public exploit code is present in the input - this is no public exploit identified at time of analysis. Real-world urgency is tempered by two factors: exploitation requires an authenticated account with permission to create or modify workflow file steps (PR:L), and the affected product is an obscure single-author open-source project with negligible deployment footprint. Despite the high 8.1 score, this reads as a genuine but low-blast-radius issue rather than a mass-exploitation priority. The diff itself is close to a recipe, so weaponization is trivial for anyone motivated, but the small install base limits widespread risk.

An authenticated user who can define a workflow file step sets step.path to a value like '../../../../etc/passwd' (read) or '../../backend/src/config.js' (write). When the executor runs the step, path.resolve escapes runtime/workflow-files and the backend reads or overwrites files with the process's permissions. No public exploit code exists, but the fix commit diff plainly reveals the mechanism.