CVE-2026-28482

The vulnerability is caused by constructing transcript paths directly from unvalidated session IDs, allowing `../` path traversal outside the sessions directory. In commit 8da4f259ddcf4206b070ff0f4b7b344535fc7eb7, `resolveSessionTranscriptPath()` was modified to build filenames as `${sessionId}-topic-${topicId}.jsonl` or `${sessionId}.jsonl` and return `path.join(resolveAgentSessionsDir(agentId), fileName)` with no session ID sanitization or containment check. The later fix adds `validateSessionId()` and `resolvePathWithinSessionsDir()` specifically to stop this, so this commit introduced the vulnerable pattern into the transcript path logic.

• •At commit 8da4f259ddcf4206b070ff0f4b7b344535fc7eb7, `src/config/sessions.ts` contains: `const fileName = topicId !== undefined ? `${sessionId}-topic-${topicId}.jsonl` : `${sessionId}.jsonl`; return path.join(resolveAgentSessionsDir(agentId), fileName);`
• •This code uses attacker-controlled `sessionId` directly in a filesystem path and does not validate it or ensure the resolved path stays within the sessions directory.
• •The fix commit replaces this with `validateSessionId(sessionId)` and `resolvePathWithinSessionsDir(...)`, demonstrating those were the security-relevant changes.
• •Commit metadata shows 8da4f259 specifically changed `resolveSessionTranscriptPath()` to support topic-specific filenames, i.e. it is the commit that introduced the vulnerable version of this path-building logic in the blamed code path.

Fallback verdict: Agent exhausted max turns without submitting a verdict.

Fallback verdict: Agent exhausted max turns without submitting a verdict.