CVE-2026-82112
- Source
- https://cve.org/CVERecord?id=CVE-2026-82112
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82112.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-82112
- Published
- 2026-08-28T11:30:11.253Z
- Modified
- 2026-08-30T03:48:22.473974410Z
- Severity
-
- 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X CVSS Calculator
- Summary
- houtini-ai houtini-lm code_task_files index.ts path traversal
- Details
-
A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src/index.ts of the component codetaskfiles. Executing a manipulation can lead to path traversal. The attack can be launched remotely. This patch is called 35d97bca0531894da36a85aedb95312da1bd5b7a. It is best practice to apply a patch to resolve this issue.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82112.json", "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "2.13.0" }, { "last_affected": "2.13.0" }, { "introduced": "2.13.1" }, { "last_affected": "2.13.1" }, { "introduced": "2.13.2" }, { "last_affected": "2.13.2" } ] } ], "cwe_ids": [ "CWE-22" ], "cna_assigner": "VulDB" }- References
-
- https://github.com/houtini-ai/houtini-lm/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82112.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-82112
- https://vuldb.com/cve/CVE-2026-82112
- https://vuldb.com/submit/887258
- https://vuldb.com/vuln/396503
- https://vuldb.com/vuln/396503/cti
- https://github.com/houtini-ai/houtini-lm/commit/35d97bca0531894da36a85aedb95312da1bd5b7a
- https://github.com/houtini-ai/houtini-lm/pull/11
- https://github.com/houtini-ai/houtini-lm/pull/11#issuecomment-5010373779