Plandex
Monthly
Path traversal in Plandex 2.2.1's ApplyFiles function allows an attacker who can influence the AI model's output - through poisoned repository files or attacker-controlled context - to write files to arbitrary locations outside the intended project directory. Targets such as shell initialization files (~/.bashrc, ~/.zshrc) and cron entries can be silently overwritten, resulting in persistent code execution under the developer's local account. No CISA KEV entry or confirmed public exploit exists at time of analysis, but the attack surface (indirect prompt injection combined with insecure file-write) is increasingly well-understood in the AI tooling threat landscape.
Path traversal in Plandex 2.2.1's ApplyFiles function allows an attacker who can influence the AI model's output - through poisoned repository files or attacker-controlled context - to write files to arbitrary locations outside the intended project directory. Targets such as shell initialization files (~/.bashrc, ~/.zshrc) and cron entries can be silently overwritten, resulting in persistent code execution under the developer's local account. No CISA KEV entry or confirmed public exploit exists at time of analysis, but the attack surface (indirect prompt injection combined with insecure file-write) is increasingly well-understood in the AI tooling threat landscape.