The-Pocket vulnerabilities

Products

• PocketFlow (pocketflow-coding-agent cookbook example) 1

Latest The-Pocket CVEs

Newest publication first

1. CVE-2026-55747 PocketFlow - Path Traversal in pocketflow-coding-agent Cookbook Example File Tools

   Published 2026-08-05

   Medium·CVSS 6.8 EPSS 0.35%

   The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity ref...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.