CVE-2026-91989 json
atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py
published 2mo ago modified last mo. also GHSA-rm43-82j9-r4mj , EUVD-2026-78660
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.do_GET endpoint to access files outside the intended agents_root directory.
Patch / fix
- pypi atomic-agents-stack 1.1.0
- dep0we atomic-agents-stack 1.1.0
Is CVE-2026-91989 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last mo.
Exploit prediction
1.33% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | atomic-agents-stack | <1.1.0 |
1.1.0 |
Affected products
- dep0we atomic-agents-stack
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/dep0we/atomic-agents-stack/commit/ec474f458122c5c0ca718d0df3078c8080338b2c
web
-
github.com
/dep0we/atomic-agents-stack/security/advisories/GHSA-rm43-82j9-r4mj
vendor-advisory, web
-
vulncheck.com
/advisories/atomic-agents-stack-before-1.1.0-path-traversal-via-dashboard-serve-py
third-party-advisory
-
github.com
/dep0we/atomic-agents-stack
package
Sources
- CVE List CVE-2026-91989
- GitHub Advisory GHSA-rm43-82j9-r4mj
- NVD CVE-2026-91989
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.