poco-ai/poco-agent <0.5.4 Data Destruction Vulnerability via Executor Task

Vulnerability Overview Title: Executor task startup deletes host data on non-container runs #131 Description: In the affected versions, the executor service deletes the runtime user's directory upon task initiation. Specifically, the method recursively deletes and replaces it with a symbolic link to workspace-local storage. This occurs before workspace preparation and Claude Agent SDK execution. Any actor capable of triggering the executor to process tasks could lead to the destructive deletion of host Claude code data, including history stored under . Impact Scope Ecosystem: GitHub Package Name: poco-ai/poco-agent Affected Versions: 0.5.4 Severity: High CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Remediation CWE: - CWE-459: Incomplete Cleanup - CWE-732: Incorrect Permission Assignment for Critical Resource POC Code Exploitation Steps 1. Create an isolated temporary home directory and place a sentinel file: 2. Start the affected executor with an isolated HOME and writable workspace: 3. Submit any valid task payload to the executor API: 4. Check the state of the HOME directory after the request is accepted: Expected Results is deleted. becomes a symbolic link pointing to . Evidence Logs Relevant Execution Paths: - : POST triggers background task execution. - : is executed upon task startup. - : uses to delete . Impact This vulnerability allows for the remote triggering of destructive local data loss in environments where the executor API is exposed to untrusted task submissions. The assets deleted include Claude code user data, such as project conversation history located in . In deployments where HOME is bind-mounted from the host into the executor container, the impact extends to host data loss beyond expected workspace boundaries. Occurrence Permalink: - Vulnerable implementation - Task execution path that invokes - Public executor API entry point that accepts task execution requests - Background task path that forwards the user-supplied request into Comments fly6511: Confirmed that the current product link does not run the executor directly on the host, but creates isolated containers via executor-manager and distributes tasks. Default container mounts do not include host HOME or ; session workspace is mounted to . The local home directory function within the target container is also fixed to and is not mounted to . YLChen-007: In the default deployment and normal usage paths, we do not currently see host being mounted to the executor's HOME, nor do we see default links triggering recursive deletion of the user's home directory. This issue appears to be a risk present only in the following non-default scenarios: 1. Developers run to bypass executor-manager directly and request the executor's endpoint directly. 2. Users manually run to override the executor's configuration and bind-mount host HOME or to the container's paths. These scenarios highlight the existence of potentially dangerous paths: should not unconditionally delete existing . However, we lean towards classifying this as a security hardening issue rather than a remote data deletion vulnerability in the default operational mode. Conclusion YLChen-007: My data in was completely deleted because I did not have a backup when running . This is a very poor experience.

Goal Reached Thanks to every supporter — we hit 100%!

poco-ai/poco-agent <0.5.4 Data Destruction Vulnerability via Executor Task

More from this source