Executive brief
Plandex is an open-source AI coding agent used to automate large software development projects. A path traversal vulnerability in version 2.2.1 allows attackers to write files outside the intended project directory, potentially achieving remote code execution by writing to critical system files like shell configuration or cron jobs.
Technical details
The vulnerability exists in the ApplyFiles function in Plandex 2.2.1 and is a path traversal flaw that fails to properly validate or sanitize file paths before writing. An attacker can manipulate the AI model's output through poisoned repository files or attacker-controlled context to specify arbitrary file paths, allowing write access outside the project directory. This could be exploited to write to sensitive locations such as shell RC files (.bashrc, .zshrc) or cron job files, achieving arbitrary code execution. The attack vector is network-based through the AI agent's file processing pipeline. A patch or update is likely available in versions after 2.2.1.
Affected products
- Plandex Plandex 2.2.1
Timeline
- 2026-09-04: disclosed