CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthorized read-only agent sessions to bypass permission checks for the project.set action, enabling attackers to redirect the server to a different project directory and gain write access. This poses a significant risk as it can lead to unauthorized modifications of project data. Organizations utilizing affected versions should prioritize remediation to prevent potential exploitation and data integrity issues.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke project.set to repoint the server at another project directory and obtain write access capabilities.