CVE-2026-85690: Plandex Path Traversal Vulnerability

CVE-2026-85690 Overview

CVE-2026-85690 is a path traversal vulnerability [CWE-22] in Plandex 2.2.1, an AI-powered coding assistant. The flaw resides in the ApplyFiles function within app/cli/lib/apply.go. Attackers can influence model output through poisoned repository files or attacker-controlled context. This causes Plandex to write files outside the intended project directory. Targets include shell resource files and cron directories, enabling arbitrary code execution on the developer's host.

Critical Impact
An attacker who controls repository content or context data can steer the language model into producing file paths that escape the project root, resulting in local code execution under the developer's account.

Affected Products

Plandex 2.2.1 (CLI)
app/cli/lib/apply.go — ApplyFiles function
Developer workstations running the vulnerable CLI

Discovery Timeline

2026-09-04 - CVE-2026-85690 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85690

Vulnerability Analysis

Plandex applies model-generated file edits to the local filesystem via the ApplyFiles routine. The function does not sufficiently validate or canonicalize the destination paths returned by the model. When the model emits a path containing ../ sequences or an absolute path, the writer follows it without confining the write to the project directory. Because Plandex ingests repository files and other context to build prompts, an attacker who controls that context can steer the model into producing traversal paths. The result is arbitrary file write in the context of the invoking developer.

Root Cause

The root cause is missing path containment in ApplyFiles. The function trusts model output as safe filesystem input. It lacks a canonicalization step that resolves the destination against the project root and rejects paths escaping that root. This maps directly to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires local execution of Plandex against attacker-influenced content and user confirmation of the apply step. An adversary plants poisoned files in a repository, issue, or other context source the developer feeds to Plandex. The prompt-injected content instructs the model to emit edits targeting paths such as ~/.bashrc, ~/.zshrc, ~/.config/, or /etc/cron.d/. When the developer applies the plan, Plandex writes the payload outside the project, achieving code execution on the next shell login or scheduled task run. Refer to the VulnCheck Advisory on Plandex 2.2.1 and GitHub Issue #352 for technical details.

Detection Methods for CVE-2026-85690

Indicators of Compromise

Unexpected modifications to shell startup files such as ~/.bashrc, ~/.zshrc, ~/.profile, or ~/.bash_profile following a Plandex session.
New or altered entries under /etc/cron.d/, /etc/cron.daily/, or user crontabs on hosts running the Plandex CLI.
File writes by the plandex process to paths outside the current project working directory.
Plandex plans referencing paths containing ../ traversal sequences or absolute paths in the destination.

Detection Strategies

Monitor process file-write telemetry from the plandex binary and alert when target paths resolve outside the invoking working directory.
Baseline shell rc and cron file hashes on developer workstations and flag drift correlated with Plandex activity.
Inspect Plandex plan output and logs for suspicious destination paths before the apply step is confirmed.

Monitoring Recommendations

Collect endpoint telemetry from developer workstations, including process ancestry, file-write events, and command-line arguments for AI coding assistants.
Alert on child processes spawned from shells shortly after Plandex activity, which may indicate execution of injected rc content.
Track outbound network connections initiated from freshly modified rc or cron scripts.

How to Mitigate CVE-2026-85690

Immediate Actions Required

Stop running Plandex 2.2.1 against untrusted repositories, issues, or third-party context sources until a patched release is deployed.
Review shell startup and cron files on any host where Plandex 2.2.1 has been executed and restore known-good versions.
Run Plandex under a dedicated, least-privileged user account that cannot write to system-wide cron or other privileged locations.

Patch Information

No fixed version is listed in the NVD record at the time of publication. Monitor the Plandex GitHub repository, the vulnerable apply.go source file, and the tracking GitHub Issue #352 for a release that adds path containment in ApplyFiles.

Workarounds

Execute Plandex inside an ephemeral container or sandbox with the project directory bind-mounted read-write and the home directory isolated.
Manually review every proposed file change and reject any plan whose destination paths contain ../ or absolute paths outside the project root.
Restrict filesystem permissions so the Plandex user cannot modify shell rc files, cron directories, or other execution-triggering locations.

bash

# Configuration example: run Plandex in an isolated container
docker run --rm -it \
  --user 1000:1000 \
  --read-only \
  --tmpfs /tmp \
  -v "$PWD":/work:rw \
  -w /work \
  plandex-sandbox:latest plandex apply