The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow uses a helper function _path(workdir, p) that wraps os.path.join(workdir, p) without performing canonicalization or containment checks. Since os.path.join returns an absolute path unchanged and does not resolve '../' sequences, an attacker can supply file-tool arguments with absolute paths or traversal sequences to read or write files outside the intended working directory. This vulnerability is classified as CWE-22 (Path Traversal). The severity is high due to potential unauthorized file access, but the impact is limited to applications that adopt this example code in production rather than the core PocketFlow library itself. No patch or official remediation is currently documented.

This vulnerability allows an attacker to read or write files outside the configured working directory by exploiting the lack of path canonicalization and containment checks. This can lead to unauthorized disclosure or modification of files on the affected system. However, the impact is limited to applications that use the vulnerable cookbook example code in production environments, as the core PocketFlow library is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the vulnerable cookbook example code in production or implement proper path canonicalization and containment checks to prevent path traversal. Specifically, ensure that file paths are resolved and validated to remain within the intended working directory before performing file operations.