CVE-2026-54520 in ai-agent-automation
Summary
by MITRE • 09/18/2026
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd() and then uses the resulting path for read or write operations without checking that it remains in an approved workflow directory. An authenticated user who can create or modify workflow file steps can supply traversal segments to escape the intended workspace and read sensitive files or write and overwrite files accessible to the backend process, including application-adjacent files when process permissions allow. This issue is fixed in version 0.9.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within AI Agent Automation prior to version 0.9.1 represents a critical path traversal flaw rooted in improper input validation and insufficient access control mechanisms. The core of the issue lies in the executeStep function located at backend/src/agents/executor.js, which handles file-step operations for workflow automation tasks. When processing these steps, the system utilizes Node.js's path.resolve method to construct absolute paths by combining a user-supplied step.path value with process.cwd(). This approach creates a false sense of security because while it generates an absolute path, it does not inherently restrict that path to remain within the designated application workspace or approved workflow directory. Consequently, if an attacker provides traversal sequences such as ../ in the step.path parameter, the resulting resolved path can escape the intended sandbox and point to arbitrary locations on the file system accessible by the backend process user account.
This architectural flaw allows authenticated users who possess the ability to create or modify workflow file steps to exploit the lack of boundary enforcement. By carefully crafting input strings that include directory traversal characters, an attacker can manipulate the resolved path to target sensitive configuration files, environment variables, source code, or other critical application-adjacent resources. The operational impact is severe, as it enables both unauthorized information disclosure and potential remote code execution depending on file write capabilities. If the backend process runs with elevated privileges or has write access to specific directories, an attacker could overwrite executable scripts, configuration files that influence system behavior, or inject malicious content into log files for later exploitation. This effectively bypasses the isolation boundaries intended by the workflow automation platform, turning a modular AI agent tool into a vector for full server compromise.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes cases where software does not properly neutralize special elements within file paths that can cause the path to resolve outside of the intended directory structure. Furthermore, in the context of the MITRE ATT&CK framework, this behavior is indicative of T1083: File and Directory Discovery for reconnaissance or T1564: Hidden Files and Directories if used to obscure malicious artifacts, though primarily it serves as a precursor to more destructive actions like T1222: File Permissions Modification. The root cause stems from relying on path resolution without subsequent validation against an allowlist of permitted directories, a common pitfall in web application development where developers assume that generating absolute paths is sufficient for security rather than explicitly checking containment within safe boundaries.
Mitigation strategies must focus on implementing strict input sanitization and access control checks before any file system operations are performed. The most effective remediation involves validating the resolved path against an explicit list of allowed directories or ensuring that the final canonical path starts with the expected base directory string after resolving all symbolic links and relative segments. Developers should utilize robust libraries designed for secure path handling rather than relying solely on standard library functions like path.resolve without additional verification layers. Additionally, applying the principle of least privilege to the backend process running AI Agent Automation is crucial; even if a traversal occurs, restricting file system permissions can limit the damage an attacker can inflict by preventing write access to critical application files and read access to sensitive system resources. Upgrading to version 0.9.1 or later resolves this issue as it includes patches that enforce these necessary boundary checks within the executor module.