Vulnerability · Published Aug 28, 2026 · Assigned by VulDB

CVE-2026-82112houtini-ai houtini-lm code_task_files index.ts path traversal

Low 3.5

In plain English

A low-severity path traversal in houtini-lm from houtini-ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.4%top 63.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src/index.ts of the component code_task_files. Executing a manipulation can lead to path traversal. The attack can be launched remotely. This patch is called 35d97bca0531894da36a85aedb95312da1bd5b7a. It is best practice to apply a patch to resolve this issue.

Affected products (as reported)

Vendor	Product	Versions
houtini-ai	houtini-lm	2.13.02.13.12.13.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

References

VDB-396503 | houtini-ai houtini-lm code_task_files index.ts path traversal vdb-entry
VDB-396503 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-82112 | CVE Analysis and Report third-party-advisory
Submit #887258 | houtini-ai houtini-lm <=2.13.2 Arbitrary Local File Read third-party-advisory
https://github.com/houtini-ai/houtini-lm/pull/11 issue-tracking, patch
https://github.com/houtini-ai/houtini-lm/pull/11#issuecomment-5010373779 issue-tracking, patch
https://github.com/houtini-ai/houtini-lm/commit/35d97bca0531894da36a85aedb95312da1bd5b7a patch
https://github.com/houtini-ai/houtini-lm/ product