The isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel.
Location: src/media/parse.ts:17-27
The path validation accepts dangerous patterns:
function isValidMedia(candidate: string, opts?: { allowSpaces?: boolean }) {
if (candidate.startsWith("/")) return true; // ALLOWS /etc/passwd
if (candidate.startsWith("./")) return true;
if (candidate.startsWith("../")) return true; // ALLOWS ../../etc/passwd
if (candidate.startsWith("~")) return true; // ALLOWS ~/secrets
return false;
}
No validation ensures the path is within a safe directory or is actually a media file.
Agent outputs any of:
MEDIA:/etc/passwd
MEDIA:~/.ssh/id_rsa
MEDIA:~/.aws/credentials
MEDIA:../../../etc/passwd
The file contents are rendered/sent to the requesting user or channel.
~/.ssh/id_rsa)~/.aws/credentials).env, config.json)/etc/passwd, /etc/shadow)Note: PR #4930 contains a fix but is NOT MERGED - production is vulnerable.
2026.1.30Exploitability
AV:NAC:LPR:LUI:NScope
S:UImpact
C:HI:NA:N6.5/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N