PrisonAI Custom Command Template Arbitrary File Read Vulnerability (GHSA-xp9x-x8c2-m9dw)

Project Custom Command Templates Allow Reading Files Outside the Workspace into Model Prompts Vulnerability Overview Vulnerability Name: Project Custom Command Templates Allow Reading Files Outside the Workspace into Model Prompts Vulnerability ID: GHSA-xp9x-x8c2-m9dw Vulnerability Type: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Severity: Medium (5.5 / 10) CVSS 3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Affected Versions: = 4.6.78 Impact Scope Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: None Availability: None Remediation Resolve command references via a single helper before opening the file: 1. Resolve the project root or expected command workspace. 2. For relative references, join them with the root directory, then call . 3. For absolute references, either reject them or require to succeed. 4. Reject escaping files before any , , or operations. 5. Apply the same boundaries to both project and user command templates. 6. Add regression tests for , , valid in-workspace files, missing files, and shell substitution escapes. POC Code Expected Vulnerability Output Impact An attacker can add or modify project commands, such as , containing or other readable files for the process. If the operator runs the project command, PrisonAI expands the external file into the prompt. In normal usage, prompts may be sent to a hosted model provider, logged, or displayed to a low-trust caller. This report only claims a confidentiality impact and does not claim code execution, arbitrary writes, credential theft, persistence, or network scanning. Proposed Severity Medium, based on a local untrusted repository threat model because the operator must run the project-defined command. Related CWEs CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Recommended Fix Resolve command references via a single helper before opening the file: 1. Resolve the project root or expected command workspace. 2. For relative references, join them with the root directory, then call . 3. For absolute references, either reject them or require to succeed. 4. Reject escaping files before any , , or operations. 5. Apply the same boundaries to both project and user command templates. 6. Add regression tests for , , valid in-workspace files, missing files, and shell substitution escapes. Minimal Example Affected Packages/Versions This feature was introduced via commit . Current release tags now include this commit; PyPI currently releases up to . Introduction Commit: Earliest Affected Version Observed: Latest Affected Version Observed: Latest PyPI Version Checked: Unaffected Sample Tag: Fixed Version: Not yet determined Affected Package Entry Ecosystem: Package: Vulnerable Versions: Fixed Version: Not yet determined Suggested History PrisonAI private reviews did not check for , , or custom command template interpolation. The closest comparator is , arbitrary file read via mentioning path traversal. This report differs as it is triggered by project-level custom command templates found in rather than direct mentions. The vulnerable code path is in , introduced via , and in . Other reviewed PrisonAI reports cover platform authorization hooks, AgentML unsigned webhooks, localhost Host-header forgery, ContextAwareRetrievalContext path escaping, API deployment YAML to Python injection, MCP and recipe policy bypasses, dynamic context path escaping, and file path escaping. None cover this custom command template interpolation path. References PrisonAI Repository: https://github.com/MervinPrison/PrisonAI Introduction Commit: - Current Test Commit: - Comparator Advisory : PrisonAI Security Policy Page: https://github.com/MervinPrison/PrisonAI/blob/main/SECURITY.md CWE-22: https://cwe.mitre.org/data/definitions/22.html CWE-200: https://cwe.mitre.org/data/definitions/200.html

Goal Reached Thanks to every supporter — we hit 100%!

PrisonAI Custom Command Template Arbitrary File Read Vulnerability (GHSA-xp9x-x8c2-m9dw)

More from this source