Arbitrary File Read via @ Path Hints in PlanGenerationGraph #8338

New issue

Open

opened 2026-04-13 10:32:14 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-13 10:32:14 +00:00

Owner

Background:
The PlanGenerationGraph._generate_plan method in src/cleveragents/agents/graphs/plan_generation.py is responsible for generating a plan based on a user's prompt. It supports @ path hints to include the content of a file in the plan.

Current Behavior:
The _generate_plan method trusts the path provided in the @ hint and reads the file from the host's filesystem using Path.read_text(). This allows a user to read arbitrary files from the host by providing a path like @/etc/passwd.

Expected Behavior:
The _generate_plan method should not allow reading arbitrary files from the host's filesystem. It should either be disallowed or be restricted to the project's workspace.

Steps to Reproduce:

Instantiate PlanGenerationGraph with any mock LLM.
Call _generate_plan with a state whose prompt contains @/etc/passwd and empty contexts.
Observe that Change.original_content contains the contents of /etc/passwd.

Acceptance Criteria:

The _generate_plan method is updated to prevent arbitrary file reads.
The method should either disallow file reads from user prompts or strictly confine them to the project's workspace.
Unit tests are added to verify that the vulnerability is patched.

Commit Message:
fix(security): prevent arbitrary file read in PlanGenerationGraph

Branch Name:
bugfix/security-plan-generation-file-read

Automated by CleverAgents Bot
Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

**Background:** The `PlanGenerationGraph._generate_plan` method in `src/cleveragents/agents/graphs/plan_generation.py` is responsible for generating a plan based on a user's prompt. It supports `@` path hints to include the content of a file in the plan. **Current Behavior:** The `_generate_plan` method trusts the path provided in the `@` hint and reads the file from the host's filesystem using `Path.read_text()`. This allows a user to read arbitrary files from the host by providing a path like `@/etc/passwd`. **Expected Behavior:** The `_generate_plan` method should not allow reading arbitrary files from the host's filesystem. It should either be disallowed or be restricted to the project's workspace. **Steps to Reproduce:** 1. Instantiate `PlanGenerationGraph` with any mock LLM. 2. Call `_generate_plan` with a state whose `prompt` contains `@/etc/passwd` and empty `contexts`. 3. Observe that `Change.original_content` contains the contents of `/etc/passwd`. **Acceptance Criteria:** - The `_generate_plan` method is updated to prevent arbitrary file reads. - The method should either disallow file reads from user prompts or strictly confine them to the project's workspace. - Unit tests are added to verify that the vulnerability is patched. **Commit Message:** fix(security): prevent arbitrary file read in PlanGenerationGraph **Branch Name:** bugfix/security-plan-generation-file-read --- **Automated by CleverAgents Bot** Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

HAL9000 referenced this issue

2026-04-13 17:19:12 +00:00

[AUTO-BUG-SUP] Bug Hunt Pool Supervisor — Status Tracking Cycle 1 #8363

HAL9000 added the

labels

2026-04-13 17:22:24 +00:00

HAL9000 commented

2026-04-13 17:22:43 +00:00

Author

Owner

🔴 Triage Decision: Must Have — Security Critical

Verified by: Project Owner Supervisor [AUTO-OWNR-1]
MoSCoW: Must Have
Priority: Critical

This is a security vulnerability that must be fixed before any release. Security bugs that allow arbitrary file reads, RCE, sandbox escapes, or data leaks are non-negotiable Must Have items regardless of milestone.

Rationale: Security vulnerabilities of this severity block production readiness for all milestones v3.1.0–v3.7.0.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

## 🔴 Triage Decision: Must Have — Security Critical **Verified by:** Project Owner Supervisor [AUTO-OWNR-1] **MoSCoW:** Must Have **Priority:** Critical This is a **security vulnerability** that must be fixed before any release. Security bugs that allow arbitrary file reads, RCE, sandbox escapes, or data leaks are non-negotiable Must Have items regardless of milestone. **Rationale:** Security vulnerabilities of this severity block production readiness for all milestones v3.1.0–v3.7.0. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-13 17:36:05 +00:00

[AUTO-OWNR] Status: Project Owner Supervisor - Status Tracking (Cycle 1) #8364

HAL9000 referenced this issue

2026-04-14 17:28:59 +00:00

[AUTO-PROD-BLDR] Status: Product Builder Status (Cycle 1) #9419