The vulnerability in SWE-agent's trajectory inspector (confirmed in v1.1.0) is a path traversal issue (CWE-22) in the /trajectory/ HTTP handler. The server joins request paths to the trajectory directory without properly rejecting parent-directory ('..') references, bypassing built-in path sanitization. Because the server binds to all interfaces (0.0.0.0), applies wildcard CORS headers, and requires no authentication, an unauthenticated network client or malicious web page can exploit this to read files outside the intended directory. The read sink parses targets as trajectory JSON, limiting disclosure to JSON files formatted as trajectories, which may contain sensitive data such as repository contents, command output, and secrets or API keys.

An unauthenticated attacker can remotely read sensitive JSON files outside the intended directory on the SWE-agent server. This can lead to disclosure of repository contents, command output, and secrets or API keys. The vulnerability does not allow modification or denial of service but results in high confidentiality impact. The server's exposure on all network interfaces and permissive CORS policy increases the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the SWE-agent trajectory inspector service, disable or limit CORS policies, and implement network-level controls to prevent unauthorized access. Monitor for updates from the vendor regarding an official fix.