CVE-2026-71492

The path traversal in DirectoryPromptRegistry (CVE-2026-71492) rates medium on CVSS but warrants higher priority than the score suggests. The vulnerability lives in how the library constructs filesystem paths from Prompt.name and Prompt.version fields — it performs no canonicalization or containment validation before writing, allowing ../ sequences to escape the intended registry directory. What makes this more than a routine traversal is the persistence mechanism. The library maintains an index.json file that serializes prompt paths, and the _load() method reconstructs paths from this manifest on restart. A successful traversal doesn't just write a malicious file — it写入 a poisoned entry that survives library upgrades, persists in git history, and propagates via backups or Docker layers. Upgrading to the fixed version (2.4.5) doesn't cleanse existing registries. Check your deployment for this exposure: audit any index.json files under your prompt registry directories for ../ sequences or absolute paths that escape the intended base directory. If you're using DirectoryPromptRegistry in a service that accepts prompt names from external sources (user input, API calls, model outputs), treat that interface as a trust boundary — validate or normalize identifiers before passing them to the library. The deeper issue is architectural. Prompt management libraries sit at the integration layer between LLM outputs and application behavior, making them unusually high-value targets. Combined with the persistence of poisoned registry entries, this creates a vulnerability with longer effective lifespan than the CVSS timeline implies. Consider registry rotation (destructive wipe and rebuild) rather than relying on patch deployment alone.

Reviewed through automated stages and approved by a human before publication.