Ag2
Monthly
Path traversal in ag2ai AG2 through version 0.13.4 allows an attacker who can influence the filename argument consumed by UserProxyAgent's os.path.join call to escape the intended working directory and read or write files with the privileges of the host process. Impact is bounded rather than catastrophic: the CVSS vector specifies PR:L, so some authorized or authenticated interaction with the agent is required, and the host application must route attacker-influenced input into that filename argument, meaning the in-process library code is not directly reachable by an unauthenticated remote attacker. Publicly available exploit code exists (a public report demonstrating legacy filename handling in a Docker environment), but there is no confirmed active exploitation and no CISA KEV listing; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Path traversal in ag2ai AG2 through version 0.13.4 allows an attacker who can influence the filename argument consumed by UserProxyAgent's os.path.join call to escape the intended working directory and read or write files with the privileges of the host process. Impact is bounded rather than catastrophic: the CVSS vector specifies PR:L, so some authorized or authenticated interaction with the agent is required, and the host application must route attacker-influenced input into that filename argument, meaning the in-process library code is not directly reachable by an unauthenticated remote attacker. Publicly available exploit code exists (a public report demonstrating legacy filename handling in a Docker environment), but there is no confirmed active exploitation and no CISA KEV listing; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.