Threats affecting pkg:pypi/griptape

CVE-2026-5597 is a medium severity path traversal vulnerability in griptape-ai griptape version 0.19.4. It affects the ComputerTool component, specifically the file griptape\tools\computer\tool.py. An attacker can manipulate the filename argument to perform path traversal remotely. The vendor has not responded to the disclosure, and no patch or remediation is currently available. Exploit code has been published, but there are no known exploits in the wild at this time.

CVE-2026-5596 is a medium severity SQL injection vulnerability affecting griptape-ai griptape version 0.19.4. The issue exists in an unknown functionality within the SqlTool component, specifically in the file griptape/tools/sql/tool.py. This vulnerability allows remote attackers to perform SQL injection attacks. The exploit code is publicly available. The vendor was contacted but has not responded or provided a patch or mitigation guidance.

CVE-2026-5595 is a medium severity path traversal vulnerability affecting version 0.19.4 of griptape-ai's griptape product. It involves the FileManagerTool component functions that handle file loading and saving, allowing an attacker with limited privileges to manipulate file paths remotely. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available. Exploits have not been observed in the wild to date.