Description

A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is called 786c9d74800e6d0858b65778f31beb71b3983a50. Applying a patch is advised to resolve this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T03:16:57.057Z",
  "pubdate": "2026-08-09T03:16:57.057Z",
  "executiveSummary": "A path traversal vulnerability has been identified in abracadabra50 claude-sesh version 1.0.0. The security flaw specifically resides within the getEnrichedData/enrichSession function located in src/services/enricher.ts.\nThis vulnerability allows an attacker to manipulate the sessionId argument, enabling unauthorized traversal of the file system and potential access to sensitive files or data outside the intended operational directory.\nThe risk implication is moderate to high, depending on the permissions of the executing process, as unauthorized file reads or data exposure may occur.\nRegarding attacker capabilities and exploitation requirements, the attack must be launched locally on the host system where the application is deployed.\nImmediate remediation involves applying the vendor-supplied patch identified by commit hash 786c9d74800e6d0858b65778f31beb71b3983a50 to resolve the improper input validation within the session enrichment logic.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and validation within the session handling logic of the application.\nThe affected component is the getEnrichedData/enrichSession function within the source file src/services/enricher.ts in abracadabra50 claude-sesh version 1.0.0.\nThe root cause is the direct concatenation or utilization of user-supplied input via the sessionId argument into file system operations without properly restricting the path scope or stripping directory traversal sequences such as dot-dot-slash (../).\nExploitation occurs locally when an attacker supplies a maliciously crafted sessionId parameter containing path traversal sequences. As the function processes this argument to load session-related data from disk, the underlying file system API resolves the relative paths outside the intended storage directory.\nThe attack flow proceeds as follows: 1. The attacker interacts with the local application environment or interface that invokes the getEnrichedData/enrichSession function. 2. The attacker injects a crafted payload containing directory traversal sequences into the sessionId argument. 3. The vulnerable function src/services/enricher.ts processes the unsanitized input to construct a file path for reading enrichment data. 4. The application attempts to access the resulting file path, allowing the reading of arbitrary files accessible to the user running the process.\nNetwork exposure is local, requiring local execution or local access vectors to supply the malicious argument to the vulnerable function. Authentication and privilege requirements depend on the local execution context, but the vulnerability inherently exposes system resources accessible to the running Node.js process."
}