CVE-2026-55747

6.8 Moyenne

Publiée le 05/08/2026 à 10:16 · Modifiée le 24/10/2026 à 18:10 · Analyse NVD reportée · Source : 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description

The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected.

Traduire en français

Produits concernés

The-Pocket PocketFlow (pocketflow-coding-agent cookbook example)

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.8 Moyenne	309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-22

Références

https://github.com/The-Pocket/PocketFlow

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories