What is the CVSS score of CVE-2026-55747?

CVE-2026-55747 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of PocketFlow Cookbook are affected by CVE-2026-55747?

PocketFlow's coding agent component contains a path traversal vulnerability enabling attackers to read and write arbitrary files on affected systems without proper access controls.

Is there a public PoC exploit available for CVE-2026-55747?

Yes, a public proof-of-concept exploit is available for CVE-2026-55747. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-55747?

Within 24 hours, inventory all production systems running pocketflow-coding-agent and document the types of files and data they access. Within 7 days, implement path canonicalization validation using os.path.realpath() on all file-tool arguments (ReadFile, ListFiles, PatchRead, PatchApply) and restrict file operations to isolated sandbox directories using chroot or container confinement. Within 30 days, evaluate migration to a hardened alternative component or retire the agent entirely if file-tool capabilities are not operationally critical.

PocketFlow Cookbook CVE-2026-55747

EUVD-2026-53195 MEDIUM

Path Traversal (CWE-22)

2026-08-05 TuranSec

GHSA-8v55-7p5p-6r5c

Path Traversal Pocketflow Pocketflow Coding Agent Cookbook Example

6.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

6.8 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network vector applies if agent is service-exposed; AC:H reflects need for crafted input; both C and I are High since read and write primitives are both bypassed; A:N as no availability impact is described.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Aug 05, 2026 - 08:22 NVD

HIGH MEDIUM

CVSS changed

Aug 05, 2026 - 08:22 NVD

7.1 (HIGH) 6.8 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 07:53 vuln.today

CVE Published

Aug 05, 2026 - 06:58 cve.org

HIGH 7.1

DescriptionCVE.org

The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a _path(workdir, p) helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Because os.path.join returns an absolute p unchanged (ignoring workdir) and does not resolve '../' sequences, an agent invocation whose file-tool arguments include an absolute path or a traversal sequence can read or write files outside the configured working directory. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected.

AnalysisAI

Path traversal in the PocketFlow pocketflow-coding-agent cookbook example exposes arbitrary filesystem reads and writes to any caller who can influence the file-tool arguments supplied to an agent invocation. The vulnerable _path(workdir, p) helper wraps os.path.join without canonicalization, meaning Python's own documented behavior - returning an absolute p unchanged and not resolving ../ sequences - silently discards the intended working-directory containment. Affected file tools include ReadFile, ListFiles, PatchRead, and PatchApply. A publicly available proof-of-concept exists; this is not confirmed in CISA KEV, but the trivial nature of the bypass (standard Python behavior) makes exploitation straightforward wherever the pattern has been copied into production.

Technical ContextAI

The affected component is the pocketflow-coding-agent cookbook example published under The-Pocket/PocketFlow (CPE: cpe:2.3:a:the-pocket:pocketflow_(pocketflow-coding-agent_cookbook_example):*:*:*:*:*:*:*:*). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), manifesting through a well-documented Python quirk: os.path.join('/safe/workdir', '/etc/passwd') returns /etc/passwd because Python treats the second argument as the new root if it is absolute. Additionally, relative traversal sequences such as ../../etc/shadow are passed through unresolved. The _path() helper performs neither os.path.realpath() normalization nor a prefix check to verify the resolved path remains under the workdir tree. This flaw propagates to four distinct file-access tools (ReadFile, ListFiles, PatchRead, PatchApply), meaning both read and write primitives are affected. The issue is classified as illustrative example code rather than a core library API, but any production system that copied or adapted this pattern is identically vulnerable.

RemediationAI

No vendor-released patched version is independently confirmed from the available data - the GitHub repository (https://github.com/The-Pocket/PocketFlow) should be monitored for a fix. Developers who have copied the _path() pattern into production must replace os.path.join(workdir, p) with a safe equivalent: first resolve the full path with os.path.realpath(os.path.join(workdir, p)), then assert that the result starts with os.path.realpath(workdir) + os.sep before permitting any file operation. Failing that assertion must raise an exception and abort the tool call. As a compensating control where immediate code changes are not feasible, restrict the OS user account running the agent to read/write permissions only on the intended workdir subtree using filesystem ACLs or a chroot/container sandbox - this limits blast radius if traversal occurs but does not eliminate the vulnerability. Running the agent inside a container with a minimal, read-only root filesystem and only the workdir volume mounted is the strongest available workaround until a patch is released.