Path Traversal Vulnerability in SWE-agent's Trajectory Inspector HTTP Server

CVE-2026-75482

What is CVE-2026-75482?

The SWE-agent's trajectory inspector is vulnerable due to its improper handling of HTTP requests in the /trajectory/ handler. It permits parent-directory references ('..'), enabling attackers to bypass path sanitization measures. This flaw allows an unauthenticated attacker, including those leveraging cross-origin resource sharing (CORS) from malicious web pages, to utilize path traversal sequences to access files located outside the intended directory structure. The server's configuration binds to all interfaces, applies wildcard CORS policies, and does not implement any authentication requirements. The resultant exposure is particularly significant as the read output is parsed as trajectory JSON, potentially leaking sensitive information such as repository contents, command outputs, and API keys.

References