griptape vulnerabilities

Griptape version 0.19.4 has a path traversal vulnerability in the ComputerTool component. A remote attacker can manipulate the filename argument to access files outside the intended directory. An exploit has been published.

SQL Injection vulnerability in griptape 0.19.4. An unknown functionality in the file griptape/tools/sql/tool.py in the SqlTool component allows manipulation leading to SQL injection. The attack can be performed remotely, and the exploit is publicly available. The vendor did not respond.

A path traversal vulnerability was found in griptape-ai griptape 0.19.4 in the FileManagerTool component. The functions load_files_from_disk, list_files_from_disk, save_content_to_file, and save_memory_artifacts_to_disk improperly validate paths, allowing remote attack. The exploit has been publicly disclosed and may be used.