Description

SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory ('..') references, bypassing the built-in path sanitization. The server binds all interfaces (0.0.0.0), applies wildcard CORS, and requires no authentication. An unauthenticated network client (or a malicious web page via CORS) can use path traversal sequences to read files outside the intended directory. Because the read sink parses targets as trajectory JSON, disclosure is constrained to JSON files shaped like a trajectory, which can contain repository contents, command output, and secrets/API keys.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T21:16:50.833Z",
  "pubdate": "2026-08-17T21:16:50.833Z",
  "executiveSummary": "SWE-agent's trajectory inspector (sweagent inspector), confirmed in version v1.1.0, suffers from a critical path traversal vulnerability within its HTTP server implementation. The vulnerability stems from improper handling of request paths in the /trajectory/ handler, allowing unauthenticated remote attackers to bypass built-in path sanitization by supplying parent-directory (..) references.\nThe HTTP server binds to all network interfaces (0.0.0.0), applies wildcard CORS policies, and enforces zero authentication. Consequently, any unauthenticated network client or malicious web page leveraging CORS can arbitrarily read files outside the intended trajectory directory. Because the application's read sink parses target files as trajectory JSON, information disclosure is constrained to JSON-formatted files possessing trajectory-like structures.\nDespite this constraint, successfully targeted files can expose sensitive repository contents, command outputs, API keys, and other critical secrets. The risk implications are severe due to the lack of access controls and the exposure of the service across all network interfaces, making deployments immediately vulnerable to remote exploitation without prior privileges.",
  "technicalDetails": "The root cause of the vulnerability resides in the /trajectory/ HTTP handler of sweagent inspector v1.1.0. When processing incoming HTTP requests, the handler unsafely joins request paths directly to the designated trajectory directory without adequately validating or rejecting parent-directory traversal sequences (..). This logic flaw effectively bypasses the built-in path sanitization mechanisms designed to restrict file access to the intended base directory.\nThe vulnerable component is the HTTP server module handling trajectory inspection. The server binds explicitly to all available network interfaces (0.0.0.0), exposing the application to external networks. Furthermore, the configuration implements wildcard Cross-Origin Resource Sharing (CORS) headers and mandates no authentication or authorization checks whatsoever.\nThe attack flow proceeds as follows: An unauthenticated attacker sends a crafted HTTP GET request to the /trajectory/ endpoint containing path traversal sequences (e.g., ../../../) targeting sensitive file locations on the underlying filesystem. Alternatively, a malicious external web page can exploit the wildcard CORS configuration to force a victim's browser to issue cross-origin requests to the locally or externally running inspector instance. The server processes the unsanitized path, resolving the file location outside the intended directory boundary.\nOnce the file is accessed, the read sink attempts to parse the retrieved target as trajectory JSON. As a result, exploitation is constrained to JSON files shaped like a trajectory. However, because trajectory files and related logs frequently encapsulate repository contents, executed command outputs, and sensitive environment variables or secrets/API keys, the post-exploitation impact includes the unauthorized disclosure of highly confidential operational and repository data.\nExploitation requirements are minimal: the attacker requires network reachability to the service port, no authentication tokens or credentials, and the ability to craft HTTP requests containing path traversal payloads or utilize browser-based CORS vectors."
}