CVE-2026-55747: PocketFlow Path Traversal Vulnerability

CVE-2026-55747 Overview

CVE-2026-55747 is a path traversal vulnerability [CWE-22] in the pocketflow-coding-agent cookbook example within the The-Pocket/PocketFlow repository. The example implements a _path(workdir, p) helper as a thin os.path.join(workdir, p) wrapper without canonicalization or containment checks. The ReadFile, ListFiles, PatchRead, and PatchApply file-access tools invoke this helper without additional guards. An attacker who controls agent tool arguments can supply absolute paths or ../ traversal sequences to read or write files outside the configured working directory.

Critical Impact
Agent invocations containing absolute paths or traversal sequences can read or write arbitrary files outside the working directory, breaking sandbox containment for downstream production applications that copy this pattern.

Affected Products

The-Pocket/PocketFlow pocketflow-coding-agent cookbook example
Applications that copy the _path(workdir, p) pattern into production
Downstream agent tools using ReadFile, ListFiles, PatchRead, PatchApply

Discovery Timeline

2026-08-05 - CVE-2026-55747 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-55747

Vulnerability Analysis

The vulnerability stems from an incorrect assumption about Python's os.path.join behavior. When any argument passed after the first is an absolute path, os.path.join discards prior components and returns the absolute path unchanged. The _path(workdir, p) helper therefore returns p directly when p is absolute, ignoring workdir entirely.

The helper also performs no canonicalization. Relative inputs containing ../ sequences remain unresolved, so the resulting path can escape workdir after operating system resolution. Because four distinct file-access tools consume this helper without additional containment checks, every file operation exposed by the agent inherits the flaw.

Exploitation requires a user to invoke the agent with attacker-influenced tool arguments. This condition aligns with the CVSS User Interaction requirement and the high attack complexity, since the attacker must shape prompts or inputs that cause the agent to call file tools with adversarial paths.

Root Cause

The root cause is missing path canonicalization and containment validation. A correct implementation must resolve the joined path with os.path.realpath and verify the result remains within the resolved workdir prefix. The cookbook example performs neither check.

Attack Vector

An attacker crafts agent input that induces a file tool call with an absolute path such as /etc/passwd or a traversal payload such as ../../etc/shadow. ReadFile and PatchRead return the contents of arbitrary readable files. PatchApply writes attacker-controlled content to arbitrary writable locations, enabling configuration tampering or code injection into files the agent process can modify.

The vulnerability description in the PocketFlow repository documents the affected helper. No public exploit code is available.

Detection Methods for CVE-2026-55747

Indicators of Compromise

Agent tool invocations containing absolute path arguments such as /etc/, /root/, or C:\Windows\ in ReadFile or PatchApply calls
Tool arguments containing ../ or ..\ sequences targeting parent directories of the configured workdir
File access events from the agent process touching paths outside the intended project directory

Detection Strategies

Instrument the _path helper to log every resolved absolute path and compare it against the configured workdir prefix
Review agent conversation logs for prompts requesting file access outside the working directory
Enable filesystem audit logging (auditd on Linux, Sysmon FileCreate events on Windows) scoped to the agent process

Monitoring Recommendations

Alert on read or write access by the agent process to sensitive paths such as /etc/passwd, ~/.ssh/, and cloud credential files
Track anomalous frequencies of PatchApply writes to paths outside the project root
Correlate agent tool call arguments with resolved filesystem paths to detect containment failures

How to Mitigate CVE-2026-55747

Immediate Actions Required

Audit production code for any copies of the _path(workdir, p) pattern from the pocketflow-coding-agent cookbook
Replace the helper with a canonicalizing implementation that resolves the joined path and verifies it stays within workdir
Run the agent process under an unprivileged account with filesystem access restricted to the intended working directory

Patch Information

This CVE affects an illustrative cookbook example rather than a core library API. Consult the PocketFlow repository for updates to the cookbook example and apply equivalent fixes to any derivative code.

Workarounds

Wrap the agent process in a filesystem sandbox such as a container with a bind-mounted working directory and no host filesystem access
Validate all file tool arguments before invocation by rejecting absolute paths and inputs containing .. components
Use os.path.realpath on the joined path and compare against os.path.realpath(workdir) with os.path.commonpath to enforce containment

bash

# Configuration example: containment check pattern to replace the vulnerable helper
# Reject the request if the resolved path escapes workdir
#
#   resolved = os.path.realpath(os.path.join(workdir, p))
#   root = os.path.realpath(workdir)
#   if os.path.commonpath([resolved, root]) != root:
#       raise PermissionError("path escapes workdir")