AIKIDO-2026-316621

TL;DR

The PythonTools toolkit builds file paths from a caller-supplied file_name in read_file, save_to_file_and_run, and run_python_file_return_variable without confirming the path stays inside the intended directory. Parent-directory sequences such as ../../etc/passwd in file_name escape the base directory. This allows reading, writing, or executing files outside the intended location with the privileges of the agent process, reachable directly or through prompt injection of agent input. The fix adds a base-directory restriction and a centralized path check that rejects paths resolving outside the base directory.