PT-2026-31665 · Agixt · Agixt

CVE-2026-39981 · Published 2026-04-08 · Updated 2026-05-13

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AGiXT versions prior to 1.9.2

Description AGiXT is a dynamic AI Agent Automation Platform. The safe join() function in the essential abilities extension does not properly validate file paths, allowing authenticated attackers to use directory traversal sequences to read, write, or delete arbitrary files on the server. The vulnerability resides in the interaction between the /api/agent/MyAgent/command API endpoint, the execute command function, and the safe join() function within the essential abilities extension. The vulnerable parameter is filename within the command args of the read file command. This can lead to credential theft, persistent code execution, or denial of service.

Recommendations Update to AGiXT version 1.9.2 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-39981

GHSA-5GFJ-64GH-MGMW

PYSEC-2026-2093

Affected Products

Agixt

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39981.json · Exploit
• https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f · Patch
• https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5gfj-64gh-mgmw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39981 · Security Note
• https://osv.dev/vulnerability/CVE-2026-39981 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2093 · Vendor Advisory
• https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2 · Note
• https://github.com/Josh-XT/AGiXT · Note
• https://twitter.com/CveFindCom/status/2042312414385913912 · Twitter Post
• https://twitter.com/CVEnew/status/2042302786076099023 · Twitter Post
• https://t.me/cveNotify/163321 · Telegram Post