Swe Agent
Monthly
Path traversal in SWE-agent's trajectory inspector component (sweagent inspector, confirmed v1.1.0) allows unauthenticated remote clients to read arbitrary JSON-formatted files from the host by injecting parent-directory sequences into the /trajectory/ HTTP endpoint. The inspector server binds to all network interfaces (0.0.0.0) with wildcard CORS and no authentication, meaning any network-reachable client or a malicious web page visited in a browser on the same host can exploit this directly without any credentials or special tooling. Disclosure is architecturally constrained to files parseable as trajectory JSON, but those files routinely capture repository contents, shell command output, and secrets or API keys recorded during prior agent sessions, making the practical impact significant despite the format restriction.
Path traversal in SWE-agent's trajectory inspector component (sweagent inspector, confirmed v1.1.0) allows unauthenticated remote clients to read arbitrary JSON-formatted files from the host by injecting parent-directory sequences into the /trajectory/ HTTP endpoint. The inspector server binds to all network interfaces (0.0.0.0) with wildcard CORS and no authentication, meaning any network-reachable client or a malicious web page visited in a browser on the same host can exploit this directly without any credentials or special tooling. Disclosure is architecturally constrained to files parseable as trajectory JSON, but those files routinely capture repository contents, shell command output, and secrets or API keys recorded during prior agent sessions, making the practical impact significant despite the format restriction.