Void AI Agent Path Traversal via Unconfined File Tools

Technical Analysis

The vulnerability stems from insufficient input validation on file-path parameters in the agent's tool layer: paths are not canonicalized or checked against a workspace root before being passed to filesystem APIs, allowing '../' sequences, absolute paths, or file:// URIs to escape the sandbox. The entry point is untrusted content the agent processes (e.g., a file, webpage, or repository the agent reads), which can contain injected instructions directing the agent to invoke these tools against sensitive host paths. Because the approval gate is bypassed or not triggered for these calls, the attacker gains read access to arbitrary host files and can chain a subsequent tool call (e.g., a network request or write operation) to exfiltrate the contents, crossing the boundary between the agent's intended workspace sandbox and the full host filesystem. This effectively converts a content-processing capability into a local file-disclosure and exfiltration primitive without requiring direct attacker access to the host.

Affected Systems

Void (AI coding agent, through version 1.3.4)

Detection Signatures

• Tool call arguments to read_file, ls_dir, get_dir_tree, or search_* containing absolute paths (e.g., /etc/, /home/, C:\Users\) or file:// URIs
• Path arguments containing traversal sequences such as '../' or '..\\' resolving outside the configured workspace root
• Agent logs showing file tool invocations immediately following ingestion of external/untrusted content (web pages, repo files, pasted text)
• Subsequent outbound network calls or write-tool invocations shortly after suspicious file reads (possible exfiltration chaining)
• Tool calls targeting known sensitive paths: ~/.ssh/, ~/.aws/credentials, ~/.config/gcloud/, environment files (.env)

Remediation Steps

1. 1

   Enforce workspace confinement

   Canonicalize all file path inputs and reject any path (including file:// URIs and absolute paths) that resolves outside the configured workspace root before invoking filesystem tool handlers.

2. 2

   Apply approval gate uniformly

   Ensure all file-reading and directory-listing tool calls, regardless of path form, require explicit human or policy-based approval; do not allow special-cased paths to bypass this gate.

3. 3

   Sanitize agent-processed content

   Treat file contents, web pages, and other ingested data as untrusted; strip or neutralize embedded instructions before they can influence tool-call arguments.

4. 4

   Restrict sensitive file access

   Explicitly deny agent tool access to known sensitive paths such as SSH keys, cloud credential files, and environment variable files at the OS or sandbox level.

5. 5

   Upgrade and monitor

   Apply vendor patches beyond version 1.3.4 once available, and monitor agent tool logs for path traversal patterns and unusual file access sequences.