AIKIDO-2026-745297

TL;DR

The local file dataset store in the Genkit tools-common package builds filesystem paths by joining a caller-supplied dataset ID directly onto the store root. Dataset IDs reach the store from unauthenticated HTTP/tRPC requests to the Dev UI / tools API server, which also listens on all network interfaces by default. A reachable attacker can supply IDs containing path separators, .. traversal segments, or null bytes to read, overwrite, or delete files outside the intended dataset directory. The fix validates dataset IDs through a resolver that rejects traversal characters and confirms the resolved path stays within the store root, tightens the dataset tRPC inputs, and binds the server to the loopback interface by default.