47Cid

The S3 API gateway fails to properly validate input in the `X-Amz-Copy-Source` header used by the `CopyObject` and `UploadPartCopy` functions. This improper validation allows the use of dot-dot path segments, leading to a path traversal condition during server-side copy source parsing. Consequently, an authenticated user restricted to a single bucket can craft requests to read and copy objects from other buckets, resulting in unauthorized data access and the breach of tenant isolation.

The `fetch url` tool implements a check using the `is restricted ip()` function to validate the resolved IP address of an initial URL against a blocklist of restricted IPs, such as localhost, private networks, and cloud metadata endpoints, to prevent Server-Side Request Forgery (SSRF). However, the `reqwest` HTTP client is configured to follow up to 5 redirects via `reqwest::redirect::Policy::limited(5)` without re-validating the redirect targets. This allows an attacker to bypass SSRF protections by providing a public URL that redirects to a restricted internal address. On cloud-hosted instances, this could lead to the exfiltration of instance metadata and cloud IAM credentials through prompt injection.

The `run tests` tool executes `cargo test` in the workspace with `ApprovalRequirement::Auto`, allowing it to run without user approval. Because `cargo test` compiles and executes arbitrary code—including test binaries, `build.rs` build scripts, and proc macros—a malicious repository can execute arbitrary shell commands, exfiltrate credentials, or establish persistence. This risk is increased by the `AGENTS.md` file, which is automatically loaded into the system prompt and can be used to instruct the model to run tests proactively at the start of a session.

The `task create` tool spawns durable sub-agents that inherit insecure default settings. Specifically, the `allow shell` variable defaults to `true` and the `auto approve` variable defaults to `true`. When a user approves a `task create` call, they may believe they are only approving a benign work prompt. However, the resulting sub-agent silently receives unrestricted and unapproved shell access. This allows the sub-agent to execute shell commands without further user intervention, potentially following malicious instructions embedded in project files.

Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. A vulnerability in how it processes hop-by-hop headers allows clients to remove X-Forwarded headers (except X-Forwarded-For). This creates potential security vulnerabilities as the receiving application should trust these headers. The attack relies on the behavior that headers can be defined as hop-by-hop via the HTTP Connection header. Some custom headers can be removed and, in certain cases, manipulated.