H2Ogpt
Monthly
Remote code execution in h2oGPT through 0.2.1 lets unauthenticated remote attackers read, write, and delete arbitrary files by injecting path traversal sequences into the HTTP bearer token of the OpenAI-compatible files API. Because the shipped default API key is empty, authentication is effectively bypassed and the token string is used directly as a filesystem path component, so an attacker can escape the user directory and plant startup hooks or application-loaded files to execute code. Publicly available exploit code exists (reported by VulnCheck); there is no public exploit identified in CISA KEV, and the CVSS 4.0 base score is 9.3 (Critical).
Remote code execution in h2oGPT through 0.2.1 lets unauthenticated remote attackers read, write, and delete arbitrary files by injecting path traversal sequences into the HTTP bearer token of the OpenAI-compatible files API. Because the shipped default API key is empty, authentication is effectively bypassed and the token string is used directly as a filesystem path component, so an attacker can escape the user directory and plant startup hooks or application-loaded files to execute code. Publicly available exploit code exists (reported by VulnCheck); there is no public exploit identified in CISA KEV, and the CVSS 4.0 base score is 9.3 (Critical).