CVE-2026-5597
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Griptape version 0.19.4 has a path traversal vulnerability in the ComputerTool component. A remote attacker can manipulate the filename argument to access files outside the intended directory. An exploit has been published.
Risk Assessment
The risk is remote file access outside the allowed directory, potentially compromising system confidentiality and integrity.
Recommendation
Immediately upgrade Griptape to a newer version if available, or apply temporary mitigations such as file path validation.
Other vulnerabilities in Griptape
See all- CVE-2026-5596Medium
SQL Injection vulnerability in griptape 0.19.4. An unknown functionality in the file griptape/tools/sql/tool.py in the SqlTool component allows manipulation leading to SQL injection. The attack can be performed remotely, and the exploit is publicly available. The vendor did not respond.
- CVE-2026-5595Medium
A path traversal vulnerability was found in griptape-ai griptape 0.19.4 in the FileManagerTool component. The functions load_files_from_disk, list_files_from_disk, save_content_to_file, and save_memory_artifacts_to_disk improperly validate paths, allowing remote attack. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
A flaw has been found in griptape-ai griptape 0.19.4. This affects an unknown part of the file griptape\tools\computer\tool.py of the component ComputerTool. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS