| 标题 | houtini-ai houtini-lm <=2.13.2 Arbitrary Local File Read |
|---|
| 描述 | houtini-lm contains an arbitrary local file read vulnerability in the code_task_files tool. The tool rejects relative paths but accepts caller-controlled absolute paths and reads any file accessible to the server process without restricting the resolved path to an intended working directory or other trusted root.
The contents of the selected files are included in requests sent to the configured LLM endpoint. When houtini-lm is configured with OpenRouter or another remotely hosted OpenAI-compatible provider, an attacker able to invoke the tool can cause sensitive local files, such as SSH keys, environment files, or cloud credentials, to be transmitted off the host.
The vulnerability may be exploited by a malicious MCP client or through prompt injection against an MCP-enabled agent. The proposed fix confines canonicalized paths to an operator-configurable allowlist of roots and rejects symbolic links that resolve outside those roots. |
|---|
| 来源 | ⚠️ https://github.com/houtini-ai/houtini-lm/pull/11 |
|---|
| 用户 | Mcfly_Zhang (UID 98877) |
|---|
| 提交 | 2026-07-13 00時33分 (2 月前) |
|---|
| 管理 | 2026-08-28 07時25分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 396503 [houtini-ai houtini-lm 直到 2.13.2 code_task_files src/index.ts 目录遍历] |
|---|
| 积分 | 20 |
|---|