---
id: CVE-2026-54520
title: >-
  AI Agent Automation is a modular AI agent workflow automation platform with
  schedulers, tools, and observability
summary: >-
  AI Agent Automation is a modular AI agent workflow automation platform with
  schedulers, tools, and observability. Prior to 0.9.1, the executeStep
  file-step implementation in backend/src/agents/executor.js passes the
  user-controlled step.…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-22
vendor: vmDeshpande
product: ai-agent-automation
affected:
  - ai-agent-automation < 0.9.1
published: '2026-09-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:25:27.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54520'
references:
  - url: >-
      https://github.com/vmDeshpande/ai-agent-automation/commit/f49ec7e85a6896b14c275222362e6ce4d445b783
    label: security-advisories@github.com
  - url: 'https://github.com/vmDeshpande/ai-agent-automation/releases/tag/v0.9.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/vmDeshpande/ai-agent-automation/security/advisories/GHSA-cm8g-8jfq-887p
    label: security-advisories@github.com
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.00491
epssPercentile: 0.3954
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/chaitanyagarware/CVE-2026-54520'
  checkedAt: '2026-09-24T21:53:34.700Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T17:24:14.931312Z'
ingestedAt: '2026-09-17T22:30:21.400Z'
---

## Overview

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd() and then uses the resulting path for read or write operations without checking that it remains in an approved workflow directory. An authenticated user who can create or modify workflow file steps can supply traversal segments to escape the intended workspace and read sensitive files or write and overwrite files accessible to the backend process, including application-adjacent files when process permissions allow. This issue is fixed in version 0.9.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.