CVE-2026-63378

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid fctr session cookie can submit arbitrary Python source in the script code field of POST /api/react/execute-script, without administrator privilege. In src/api/routers/react stream.py, the source is stored with skip discovery=True, bypassing AI-based content filtering, and is passed to validate generated code in src/utils/security config.py. BLOCKED PATTERNS recognizes direct import calls but misses the import name passed as a string, getattr is in ALLOWED BUILTINS, and the AST checker handles ast.Name and ast.Attribute targets but fails to handle ast.Call targets. Dynamic getattr call chains through builtins therefore evade validation. The write temp script helper writes the accepted code to disk, and asyncio.create subprocess exec() executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through GET /api/react/stream-react-updates?process id=<id>. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.