Executive brief
AGiXT is an automation platform used to build and manage AI agents. A security flaw in the platform's file handling allows an authorized user to bypass security restrictions and access files outside of their assigned workspace. This could lead to the theft of sensitive server data, the modification of system files, or the deletion of critical information, potentially compromising the entire server hosting the AI agents.
Technical details
A path traversal vulnerability exists in the `safe_join()` function within the `essential_abilities` extension of AGiXT. The root cause is a failure to properly validate that resolved file paths remain within the `WORKING_DIRECTORY` after joining user-supplied input. An authenticated attacker with a valid API key can provide directory traversal sequences (e.g., `../../etc/passwd`) via command arguments like `filename` in the `read_file` command. This allows for arbitrary file read, write, and delete operations on the underlying host server. The issue is addressed in version 1.9.2 by ensuring the resulting path is strictly contained within the agent's designated workspace.
Affected products
- Josh-XT AGiXT < 1.9.2
Timeline
- 2026-03-15: patched: Version 1.9.2 released
- 2026-04-08: advisory: Vendor security advisory published via GitHub
- 2026-04-09: disclosed: CVE-2026-39981 published