CVE-2026-82112: houtini-ai houtini-lm code_task_files index.ts path traversal
A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src/index.ts of the component codetaskfiles. Executing a manipulation can lead to path traversal. The attack can be launched remotely. This patch is called 35d97bca0531894da36a85aedb95312da1bd5b7a. It is best practice to apply a patch to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
houtini-ai houtini-lm code_task_files index.ts path traversalto a version that resolves this vulnerability.Fixed in 2.13.2Patch 35d97bca0531894da36a85aedb95312da1bd5b7a - Compensating control
Since the path traversal can be launched remotely, restrict network access to the service/component using houtini-ai houtini-lm code_task_files (e.g., limit reachable endpoints/hosts via firewall or network allowlist) until the patch is applied.
Event History
Frequently Asked Questions
What access and interaction are required to exploit this issue?
The vector indicates that the issue can be reached remotely with low attack complexity. An attacker must have low-level privileges and requires user interaction to exploit it.
Which versions are affected and what remediation is available?
houtini-lm versions up to 2.13.2 are affected. Apply the fix identified by commit 35d97bca0531894da36a85aedb95312da1bd5b7a.