Description

A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src/index.ts of the component code_task_files. Executing a manipulation can lead to path traversal. The attack can be launched remotely. This patch is called 35d97bca0531894da36a85aedb95312da1bd5b7a. It is best practice to apply a patch to resolve this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-28T16:18:31.610Z",
  "pubdate": "2026-08-28T16:18:31.610Z",
  "executiveSummary": "A path traversal vulnerability has been identified in the code_task_files component of houtini-ai houtini-lm, affecting all versions up to and including 2.13.2.\nThe vulnerability originates from inadequate validation of user-supplied input used in file system operations within src/index.ts.\nThis flaw enables remote attackers to manipulate file paths, potentially leading to unauthorized access to arbitrary files on the underlying host system outside the intended directory.\nThe risk is significant as it allows for the disclosure of sensitive information or potentially malicious file manipulation depending on the application's file write capabilities.\nNo authentication is required to initiate this attack, making it reachable via remote network vectors.\nOrganizations using houtini-lm are advised to update to a version that incorporates patch 35d97bca0531894da36a85aedb95312da1bd5b7a to mitigate this risk.",
  "technicalDetails": "The vulnerability is a classic path traversal flaw located within the code_task_files component, specifically affecting the handling of file paths in src/index.ts. The root cause is the failure of the application to properly sanitize and validate input parameters before using them to construct file system paths.\nIn the vulnerable implementation, user-supplied data—which is likely intended to designate a specific file for a task—is concatenated directly into a file system path without sufficient checks for directory traversal sequences (e.g., '../').\nAn attacker can exploit this by crafting a malicious request where the input contains traversal sequences. When the application processes this input, the path resolution mechanism interprets the '../' characters as instructions to traverse upward in the directory tree. This enables the attacker to break out of the designated directory constraint and access files or directories that the application process has permission to read or manipulate.\nThe attack vector is remote, requiring no authentication, which increases the potential impact. By successfully injecting path traversal sequences, an attacker can bypass intended security boundaries.\nThe exploitation flow is as follows: 1) The attacker identifies a request parameter within the code_task_files component that influences file system access; 2) The attacker submits a specially crafted string containing traversal sequences (e.g., '../../../../etc/passwd' on a Linux-based system) instead of a simple filename; 3) The application, failing to validate or sanitize the path, constructs the full path including the traversal sequences; 4) The underlying system resolves the path and grants the application access to the file located at the unintended path; 5) The application returns the contents of the unauthorized file to the attacker or performs a write operation on the unintended path if the functionality allows it.\nThis vulnerability compromises the integrity and confidentiality of the file system hosting the houtini-lm component. Successful exploitation can lead to the exfiltration of sensitive configuration files, source code, or application data, potentially leading to a full system compromise depending on the context in which the houtini-lm process is executing."
}