PYSEC-2026-4010

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/local-operator/PYSEC-2026-4010.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-4010
Aliases
  • GHSA-3xjw-9qpc-53mh
Published
2026-09-05T07:44:09Z
Modified
2026-09-30T16:46:03Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit
Details

The /v1/chat/agents/{agent_id}/edit endpoint in local-operator versions before 0.47.5 resolves the caller-supplied file_path with expanduser().resolve() and reads it without checking that it lies inside the agent's workspace. An unauthenticated client with network access to the API can supply an absolute path or a path containing traversal sequences and obtain the contents of any file readable by the server process, which are placed in the model prompt and returned in the response.

Version 0.47.5 resolves server-side reads within the agent's configured workspace and rejects canonical paths outside it (including symlink and junction escapes) before any model call, adds an optional file_content request field so clients can submit a buffer without host path resolution, and binds lop serve to 127.0.0.1 by default.

Database specific 
{
    "cwe_ids":  [
        "CWE-22",
        "CWE-200"
    ]
}
References
Credits
    • mhdgning131 - REPORTER

Affected packages

PyPI / local-operator

Package

Name
local-operator
View open source insights on deps.dev
Purl
pkg:pypi/local-operator

Affected ranges

Type
GIT
Repo
https://github.com/damianvtran/local-operator
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
29fc4c68a3ed1d238b8abf6b6a6136a3361416a5
Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.47.5

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.9
0.0.10
0.0.11
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.20
0.0.21
0.0.22
0.0.23
0.0.24
0.0.25
0.0.26
0.0.27
0.0.28
0.0.29
0.1.0
0.1.1
0.1.2
0.1.3b0
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.2.0b0
0.2.0b1
0.2.0b2
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.2.15
0.2.16
0.2.17
0.2.18
0.3.0b0
0.3.0b1
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.4.0b1
0.4.0b2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.8.0
0.8.1
0.8.2
0.9.0
0.10.0
0.11.0
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
0.12.1
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
0.15.8
0.15.9
0.15.10
0.16.0
0.16.1
0.17.0
0.17.1
0.17.3
0.17.5
0.18.0
0.18.1
0.19.0
0.19.1
0.19.2
0.20.0
0.20.1
0.21.0
0.22.0
0.23.0
0.23.1
0.24.0
0.24.1
0.24.2
0.24.3
0.24.4
0.24.5
0.24.6
0.24.7
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.26.0
0.27.0
0.27.1
0.27.2
0.27.3
0.28.0
0.28.1
0.29.0
0.30.0
0.31.0
0.31.1
0.32.0
0.32.1
0.33.0
0.33.1
0.33.2
0.34.0
0.35.0
0.35.1
0.36.0
0.37.0
0.38.0
0.38.1
0.39.0
0.40.0
0.41.0
0.41.2
0.41.3
0.41.4
0.41.5
0.41.6
0.41.7
0.41.8
0.41.9
0.41.10
0.42.0
0.42.1
0.42.2
0.42.3
0.42.4
0.42.5
0.42.6
0.42.7
0.42.8
0.42.9
0.42.10
0.42.11
0.42.12
0.42.13
0.42.14
0.42.15
0.42.16
0.42.17
0.42.18
0.42.19
0.42.20
0.43.0
0.43.2
0.43.3
0.43.4
0.43.5
0.43.6
0.43.7
0.43.8
0.43.9
0.43.10
0.43.11
0.43.12
0.43.13
0.43.14
0.43.15
0.43.16
0.43.17
0.43.18
0.44.0
0.44.1
0.44.2
0.44.3
0.44.4
0.44.5
0.44.6
0.44.7
0.44.8
0.44.9
0.44.10
0.44.11
0.44.12
0.44.13
0.44.14
0.44.15
0.44.16
0.44.17
0.44.18
0.44.19
0.44.20
0.44.21
0.44.22
0.44.23
0.44.24
0.44.25
0.44.26
0.44.27
0.44.28
0.44.29
0.44.30
0.44.31
0.44.32
0.44.36
0.44.37
0.44.38
0.44.39
0.44.40
0.44.41
0.44.42
0.44.43
0.44.44
0.44.45
0.44.46
0.44.47
0.44.48
0.44.49
0.44.50
0.44.51
0.44.52
0.44.53
0.44.54
0.44.55
0.44.56
0.44.58
0.44.59
0.44.60
0.44.61
0.44.62
0.44.63
0.44.64
0.44.65
0.44.66
0.44.67
0.44.68
0.44.69
0.44.70
0.44.71
0.45.1
0.45.2
0.45.3
0.45.4
0.45.5
0.45.6
0.45.7
0.46.0
0.46.1
0.46.4
0.46.6
0.46.7
0.46.8
0.46.9
0.46.10
0.46.11
0.46.12
0.46.13
0.46.14
0.46.17
0.46.18
0.46.19
0.46.21
0.46.22
0.46.23
0.46.24
0.46.25
0.46.26
0.47.0
0.47.1
0.47.2
0.47.3
0.47.4
v0.*
v0.0.1
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v0.0.10
v0.0.12
v0.0.13
v0.0.14
v0.0.15
v0.0.16
v0.0.17
v0.0.18
v0.0.19
v0.0.20
v0.0.21
v0.0.22
v0.0.23
v0.0.24
v0.0.25
v0.0.26
v0.0.27
v0.0.29
v0.1.0
v0.1.1
v0.1.2
v0.1.3b0
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.2.0b1
v0.2.0b2
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.2.10
v0.2.11
v0.2.12
v0.2.13
v0.2.14
v0.2.15
v0.2.16
v0.2.17
v0.2.18
v0.3.0b0
v0.3.0b1
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.4.0b1
v0.4.0b2
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.5.0
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.8.0
v0.8.1
v0.8.2
v0.9.0
v0.10.0
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.11.4
v0.12.0
v0.12.1
v0.13.0
v0.14.0
v0.14.1
v0.14.2
v0.15.0
v0.15.1
v0.15.2
v0.15.3
v0.15.4
v0.15.5
v0.15.6
v0.15.7
v0.15.8
v0.15.9
v0.15.10
v0.16.0
v0.16.1
v0.17.0
v0.17.1
v0.17.3
v0.17.5
v0.18.0
v0.18.1
v0.19.0
v0.19.1
v0.19.2
v0.20.0
v0.20.1
v0.21.0
v0.22.0
v0.23.0
v0.23.1
v0.24.0
v0.24.1
v0.24.2
v0.24.3
v0.24.4
v0.24.5
v0.24.6
v0.24.7
v0.25.0
v0.25.1
v0.25.2
v0.25.3
v0.25.4
v0.26.0
v0.27.0
v0.27.1
v0.27.2
v0.27.3
v0.28.0
v0.28.1
v0.29.0
v0.30.0
v0.31.0
v0.31.1
v0.32.0
v0.32.1
v0.33.0
v0.33.1
v0.33.2
v0.34.0
v0.35.0
v0.35.1
v0.36.0
v0.37.0
v0.38.0
v0.38.1
v0.39.0
v0.40.0
v0.41.0
v0.41.1
v0.41.2
v0.41.3
v0.41.4
v0.41.5
v0.41.6
v0.41.7
v0.41.8
v0.41.9
v0.41.10
v0.42.0
v0.42.1
v0.42.2
v0.42.3
v0.42.4
v0.42.5
v0.42.6
v0.42.7
v0.42.8
v0.42.9
v0.42.10
v0.42.11
v0.42.12
v0.42.13
v0.42.14
v0.42.15
v0.42.16
v0.42.17
v0.42.18
v0.42.19
v0.42.20
v0.43.0
v0.43.2
v0.43.3
v0.43.4
v0.43.5
v0.43.6
v0.43.7
v0.43.8
v0.43.9
v0.43.10
v0.43.11
v0.43.12
v0.43.13
v0.43.14
v0.43.15
v0.43.16
v0.43.17
v0.43.18
v0.44.0
v0.44.1
v0.44.2
v0.44.3
v0.44.4
v0.44.5
v0.44.6
v0.44.7
v0.44.8
v0.44.9
v0.44.10
v0.44.11
v0.44.12
v0.44.13
v0.44.14
v0.44.15
v0.44.16
v0.44.17
v0.44.18
v0.44.19
v0.44.20
v0.44.21
v0.44.22
v0.44.23
v0.44.24
v0.44.25
v0.44.26
v0.44.27
v0.44.28
v0.44.29
v0.44.30
v0.44.31
v0.44.32
v0.44.36
v0.44.37
v0.44.38
v0.44.39
v0.44.40
v0.44.41
v0.44.42
v0.44.43
v0.44.44
v0.44.45
v0.44.46
v0.44.47
v0.44.48
v0.44.49
v0.44.50
v0.44.51
v0.44.52
v0.44.53
v0.44.54
v0.44.55
v0.44.56
v0.44.58
v0.44.59
v0.44.60
v0.44.61
v0.44.62
v0.44.63
v0.44.64
v0.44.65
v0.44.66
v0.44.67
v0.44.68
v0.44.69
v0.44.70
v0.44.71
v0.45.1
v0.45.2
v0.45.3
v0.45.4
v0.45.5
v0.45.6
v0.45.7
v0.46.0
v0.46.1
v0.46.4
v0.46.6
v0.46.7
v0.46.8
v0.46.9
v0.46.10
v0.46.11
v0.46.12
v0.46.13
v0.46.14
v0.46.17
v0.46.18
v0.46.19
v0.46.21
v0.46.22
v0.46.23
v0.46.24
v0.46.25
v0.46.26
v0.47.0
v0.47.1
v0.47.2
v0.47.3
v0.47.4

Ecosystem specific 

{
    "imports":  [
        {
            "attribute":  "edit_file_with_agent",
            "modules":  [
                "local_operator.server.routes.chat"
            ]
        }
    ]
}

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/local-operator/PYSEC-2026-4010.yaml"