Threats tagged 'ghsa-fg23-3346-88f5'

Langroid's ReadFileTool and WriteFileTool do not properly restrict file operations to the configured current directory (curr_dir). They change the process working directory to curr_dir but do not validate that file paths remain within this directory, allowing path traversal sequences like '../' to read or write files outside the intended boundary. This can lead to unauthorized reading or modification of files outside the sandbox or project directory. The vulnerability affects versions of Langroid prior to 0.64.0.