CVE-2026-76832

The CVSS 8.8 on this path traversal in PythonTools is misleading. Don't lead with patching the traversal — lead with the fact that your AI agent just became the exploit delivery mechanism. When an agent processes scraped web content, email attachments, or user documents containing '../' sequences, it passes those traversal payloads to PythonTools' file operations as part of its normal reasoning cycle. You are no longer defending against someone calling your API with crafted requests. You are defending against an autonomous agent that will dutifully deliver the exploit for you, inside the agent process's security context, potentially across multiple conversation threads. The three-tool interface (read_file, save_to_file, run_python_file) creates a complete compromise chain in a single pivot: read ~/.aws/credentials, write a malicious .bashrc, execute persistence. This isn't three vulnerabilities — it's one traversal primitive enabling a full kill chain that traditional path traversal CVEs rarely achieve. Your CVSS score assumes direct API abuse. This is agent-mediated compromise, which fundamentally changes the threat model. The agent's ability to receive instructions and act on them means the 'intended base_dir boundary' was never a meaningful control — it relies entirely on correct input validation in a system designed to process untrusted content. That's not a boundary; it's a wish. Prioritize these controls in order: first, sandbox the agent process so file operations run with minimal privilege and no persistence capability. Second, normalize all file_name inputs before the base_dir check — resolve '..' sequences and validate the canonical path stays within the intended directory. Third, implement tool access controls that restrict which tools can be chained in a single agent turn, breaking the read-write-execute pivot. Fourth, audit what credentials and resources the agent process can reach — assume compromise and limit blast radius accordingly. The patch will ship. The normalization check will be added. Then the framework will evolve: new tools, new input sources, new integrations. The security control sits static while the attack surface grows horizontally. Document why the normalization exists, not just that it does — in six months, someone will add a 'read_csv' tool without realizing they're reopening the same terminal point on the traversal primitive. Your architecture assumes tool inputs are trusted. That assumption is now an active hazard.

Reviewed through automated stages and approved by a human before publication.