AIKIDO-2026-634908
@genkit-ai/telemetry-server is vulnerable to Path Traversal
65
Medium Risk
This Affects:
@genkit-ai/telemetry-serverTL;DR
The local file trace store in the Genkit telemetry server builds filesystem paths by joining a caller-supplied trace ID directly onto the store root. Trace IDs reach the store from unauthenticated HTTP requests to the telemetry server, which also listens on all network interfaces by default. A reachable attacker can supply IDs containing path separators, .. traversal segments, or null bytes to read or overwrite files outside the intended trace directory. The fix validates trace IDs through a resolver that rejects traversal characters and confirms the resolved path stays within the store root, and binds the server to the loopback interface by default.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the Genkit telemetry server backed by the local file trace store.
Background info
@genkit-ai/telemetry-server is vulnerable to Path Traversal in versions 0.9.0 - 1.39.0.
How to fix this
Upgrade the @genkit-ai/telemetry-server library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant