The pocketflow‑coding‑agent cookbook example in The‑Pocket’s PocketFlow includes a helper that simply joins a working directory and a supplied path via os.path.join without performing canonicalization or containment checks. This helper is used by the ReadFile, ListFiles, PatchRead, and PatchApply file‑access tools without any guard clauses. As a result, an attacker who can supply a path argument can navigate outside the intended directory, allowing the agent to read or modify arbitrary files. Although the flaw resides in an illustrative cookbook example rather than a core library API, applications that copy this pattern into production can be affected with the same arbitrary file read/write capability.

The vulnerable code resides in The‑Pocket’s PocketFlow, specifically the pocketflow‑coding‑agent cookbook example. No exact version information is supplied, so any deployment that includes this example and exposes its file‑tool helpers may be affected.

The vulnerability scores a CVSS of 6.8 and is not listed in CISA’s KEV catalog. Because the bug permits file access through untrusted input to helpers used by several file‑tool commands, an attacker who can supply arguments to the agent—either via a local interface or an exposed API—can exploit the flaw. The EPSS score of less than 1% indicates a very low exploitation probability, yet the moderate severity warrants that exposure be addressed promptly.