Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Local-operator versions before 0.47.5 let the /v1/chat/agents/{agent_id}/edit endpoint read any file the server process can access, because the caller-supplied file_path is not checked against the agent's workspace. An unauthenticated client with network access to the API can exploit this with absolute or traversal paths, and the file contents are sent to the model and returned in the response. Upgrade local-operator to 0.47.5 or later, which confines server-side reads to the agent's workspace and binds lop serve to 127.0.0.1 by default.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | OSV |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 14:09 UTC First seen by agentprime
- 31 Oct 2026, 14:09 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-3xjw-9qpc-53mh
- OSV: GHSA-3xjw-9qpc-53mh
- github.com/damianvtran/local-operator/security/advisories/GHSA-3xjw-9qpc-53mh
- github.com/damianvtran/local-operator/pull/643
- github.com/damianvtran/local-operator/commit/29fc4c68a3ed1d238b8abf6b6a6136a3361416a5
- github.com/damianvtran/local-operator/releases/tag/v0.47.5
- pypi.org/project/local-operator/