CVE-2026-5597

MediumCVSS 6.3/10Last modified Jul 24, 2026

Description

A flaw has been found in griptape-ai griptape 0.19.4. This affects an unknown part of the file griptape\tools\computer\tool.py of the component ComputerTool. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Apr 5, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-559706.5Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to up CVE-2026-559719.8Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recomme CVE-2026-559737.5In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) fr CVE-2026-559757.2A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certific CVE-2026-559769.1Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CVE-2026-559773.3Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the application's rate-limiting me CVE-2026-559788.4An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel CVE-2026-559795.2An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. CVE-2026-55987.5Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associat CVE-2026-559805.5A denial-of-service vulnerability in CatchPulse could allow an attacker to conduct a stack buffer overrun attack, leading to a denial-of-ser CVE-2026-559819.6A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upl CVE-2026-559829.1OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes