A path traversal vulnerability (CVE-2026-5597) affects griptape-ai griptape version 0.19.4 in the ComputerTool component. The issue arises from improper handling of the filename argument in griptape\tools\computer\tool.py, enabling remote attackers to manipulate file paths and access unauthorized files. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating network attack vector with low complexity and no user interaction required. The vendor was contacted but did not provide a response or patch. No official remediation or patch links are available, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation of this vulnerability allows remote attackers to perform path traversal attacks by manipulating the filename argument, potentially accessing files outside the intended directory. This could lead to unauthorized information disclosure or other impacts depending on the files accessed. However, the CVSS score and vector indicate limited impact with low complexity and no privileges required, and no confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to vulnerable versions, applying any available workarounds, or implementing input validation controls to mitigate path traversal risks until a patch is released.