| शीर्षक | poco-ai poco-agent 0.5.4 Incomplete Cleanup (CWE-459) |
|---|
| विवरण | # Technical Details
A Destructive Local File Deletion vulnerability exists in the `_setup_session_persistence()` method in `executor/app/core/workspace.py` of poco-agent.
The application fails to check whether `~/.claude` contains user data before deleting it. During task startup, `WorkspaceManager.prepare()` calls `_setup_session_persistence()`, which unconditionally executes `shutil.rmtree(Path.home() / ".claude")` if the directory exists and is not a symlink, then replaces it with a symlink to workspace-local storage. This happens before any repository preparation or agent logic execution, so any valid task payload sent to `POST /v1/tasks/execute` can trigger destructive deletion of host Claude Code data including chat history under `~/.claude/projects`.
# Vulnerable Code
File: executor/app/core/workspace.py
Method: _setup_session_persistence()
Why: The method unconditionally calls shutil.rmtree(self.system_claude_home) where self.system_claude_home = Path.home() / ".claude", deleting all user Claude Code data before replacing it with a symlink. No check is performed to preserve existing user data or warn the user.
# Reproduction
1. Create an isolated test home with sentinel data: `mkdir -p /tmp/test_home/.claude/projects && echo important > /tmp/test_home/.claude/projects/sentinel.txt`
2. Start the affected executor (v0.5.4) with the isolated HOME: `HOME=/tmp/test_home WORKSPACE_PATH=/tmp/test_home/workspace uv run python -m app.main`
3. Submit any valid task payload: `curl -X POST http://127.0.0.1:8080/v1/tasks/execute -H 'Content-Type: application/json' -d '{"session_id":"poc","run_id":"poc-run","prompt":"hello","callback_url":"http://127.0.0.1:9999/callback","callback_token":"dummy","config":{}}'`
4. Verify the sentinel file is deleted and ~/.claude has been replaced with a symlink to workspace storage.
# Impact
- Remote triggering of destructive local data loss via the executor API without any malicious prompt content needed
- Permanent deletion of Claude Code user data including project conversation history under ~/.claude/projects
- In deployments where HOME is bind-mounted from host into executor container, impact extends to host data loss outside the intended workspace boundary |
|---|
| स्रोत | ⚠️ https://github.com/poco-ai/poco-claw/issues/131 |
|---|
| उपयोगकर्ता | JondaChen (UID 99096) |
|---|
| सबमिशन | 18/06/2026 11:10 AM (2 महीनों पहले) |
|---|
| संयम | 05/08/2026 11:29 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 386419 [poco-ai poco-agent तक 0.5.4 Claude File workspace.py WorkspaceManager._setup_session_persistence] |
|---|
| अंक | 20 |
|---|