Pocketflow Pocketflow Coding Agent Cookbook Example
Monthly
Path traversal in the PocketFlow pocketflow-coding-agent cookbook example exposes arbitrary filesystem reads and writes to any caller who can influence the file-tool arguments supplied to an agent invocation. The vulnerable `_path(workdir, p)` helper wraps `os.path.join` without canonicalization, meaning Python's own documented behavior - returning an absolute `p` unchanged and not resolving `../` sequences - silently discards the intended working-directory containment. Affected file tools include ReadFile, ListFiles, PatchRead, and PatchApply. A publicly available proof-of-concept exists; this is not confirmed in CISA KEV, but the trivial nature of the bypass (standard Python behavior) makes exploitation straightforward wherever the pattern has been copied into production.
Path traversal in the PocketFlow pocketflow-coding-agent cookbook example exposes arbitrary filesystem reads and writes to any caller who can influence the file-tool arguments supplied to an agent invocation. The vulnerable `_path(workdir, p)` helper wraps `os.path.join` without canonicalization, meaning Python's own documented behavior - returning an absolute `p` unchanged and not resolving `../` sequences - silently discards the intended working-directory containment. Affected file tools include ReadFile, ListFiles, PatchRead, and PatchApply. A publicly available proof-of-concept exists; this is not confirmed in CISA KEV, but the trivial nature of the bypass (standard Python behavior) makes exploitation straightforward wherever the pattern has been copied into production.