Description
A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src/index.ts of the component code_task_files. Executing a manipulation can lead to path traversal. The attack can be launched remotely. This patch is called 35d97bca0531894da36a85aedb95312da1bd5b7a. It is best practice to apply a patch to resolve this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| houtini-ai | houtini-lm | 2.13.0, 2.13.1, 2.13.2 | — |
References
- VDB-396503 | houtini-ai houtini-lm code_task_files index.ts path traversal vdb-entry
- VDB-396503 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-82112 | CVE Analysis and Report third-party-advisory
- Submit #887258 | houtini-ai houtini-lm <=2.13.2 Arbitrary Local File Read third-party-advisory
- https://github.com/houtini-ai/houtini-lm/pull/11 issue-tracking patch
- https://github.com/houtini-ai/houtini-lm/pull/11#issuecomment-5010373779 issue-tracking patch
- https://github.com/houtini-ai/houtini-lm/commit/35d97bca0531894da36a85aedb95312da1bd5b7a patch
- https://github.com/houtini-ai/houtini-lm/ product