The vulnerability in vmDeshpande ai-agent-automation (before 0.9.1) arises from improper limitation of a pathname to a restricted directory (CWE-22). The executeStep file-step implementation in backend/src/agents/executor.js uses path.resolve with process.cwd() on a user-controlled step.path value but does not verify that the resolved path remains within an approved workflow directory. This allows an authenticated user who can create or modify workflow file steps to supply path traversal segments to escape the intended workspace directory. Consequently, the user can read sensitive files or write and overwrite files accessible to the backend process, including files adjacent to the application, depending on process permissions. The issue is addressed in version 0.9.1.

An authenticated user with the ability to create or modify workflow file steps can exploit this vulnerability to read sensitive files or write/overwrite files outside the intended workspace directory. This can lead to disclosure of sensitive information and unauthorized modification of files accessible to the backend process. The CVSS 3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality and integrity impact with no availability impact.

This vulnerability is fixed in vmDeshpande ai-agent-automation version 0.9.1. Users should upgrade to version 0.9.1 or later to remediate this issue. No other mitigation or temporary workaround is indicated.