A critical path traversal vulnerability in Plandex 2.2.1 allows attackers to achieve remote code execution by writing malicious files outside the intended project directory.

The application is susceptible to a path traversal flaw within the ApplyFiles function, which fails to properly sanitize input when writing files. An attacker can leverage this by providing poisoned repository files or malicious context to overwrite system files, such as shell initialization or cron scripts, to gain code execution.

Successful exploitation of this vulnerability results in full system compromise, as the attacker can execute arbitrary code with the privileges of the user running the Plandex CLI. This poses a severe risk to data integrity, confidentiality, and overall system availability. With a CVSS score of 7.8, the vulnerability is categorized as high severity, reflecting the significant potential for lateral movement and persistent access within the development environment.

Immediate Action: There is currently no official patch available; users should restrict Plandex usage to highly trusted environments and avoid processing untrusted repositories or model outputs until a fix is released.

Proactive Monitoring: Security teams should monitor file system activity for unexpected modifications to sensitive configuration files, such as those in the home directory or system cron locations.

Compensating Controls: Since the vulnerability involves malicious repository content, ensure that all project files and AI model inputs are vetted and originate from trusted, authenticated sources to prevent the injection of path traversal payloads.

Public Exploit Available: Unknown

Given the potential for complete system takeover, organizations utilizing Plandex must treat this vulnerability with high priority. Monitor vendor channels closely for the release of an updated version and apply the patch as soon as it becomes available. In the interim, enforce strict access controls on the environments where Plandex is deployed to limit the blast radius of a potential compromise.