CVE-2026-82112: Path Traversal in houtini-ai houtini-lm
Description
CVE-2026-82112 is a medium severity path traversal vulnerability found in houtini-ai's houtini-lm product up to version 2.13.2. The flaw exists in an unspecified function within the src/index.ts file of the code_task_files component. This vulnerability can be exploited remotely and may allow an attacker to manipulate file paths. A patch identified by commit 35d97bca0531894da36a85aedb95312da1bd5b7a has been created to address this issue. Users are advised to apply this patch to mitigate the risk.
CVSS v4.0
Score 5.1medium
Affected software
houtini-ai
houtini-lm
cpe:2.3:a:houtini-ai:houtini-lm:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves a path traversal flaw in houtini-lm versions 2.13.0, 2.13.1, and 2.13.2, specifically in an unknown function of the src/index.ts file within the code_task_files component. The flaw allows remote attackers to manipulate file paths, potentially accessing unauthorized files or directories. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. A patch exists, referenced by the commit hash 35d97bca0531894da36a85aedb95312da1bd5b7a, which should be applied to remediate the issue.
Potential Impact
Successful exploitation of this vulnerability could allow a remote attacker with limited privileges and requiring user interaction to perform path traversal attacks. This may lead to unauthorized access to files outside the intended directory scope. The CVSS score of 5.1 reflects a medium impact on confidentiality and integrity with no impact on availability.
Mitigation Recommendations
A patch identified by commit 35d97bca0531894da36a85aedb95312da1bd5b7a is available and should be applied to affected versions 2.13.0, 2.13.1, and 2.13.2 of houtini-lm. Since the vendor advisory or official remediation level is not explicitly provided, users should verify the patch status with the vendor or official sources before deployment.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-28T05:25:22.452Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a91ab5facd9273b490ac037
Added to database: 08/28/2026, 15:38:07 UTC
Last enriched: 09/09/2026, 22:23:49 UTC
Last updated: 10/12/2026, 18:48:23 UTC
Views: 73
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.