CVE-2026-75482

Name of the Vulnerable Software and Affected Versions SWE-agent's trajectory inspector version 1.1.0

Description The HTTP server fails to properly sanitize request paths in the '/trajectory/' endpoint, allowing the use of parent-directory ('..') references to perform path traversal. The server binds to all interfaces (0.0.0.0), uses wildcard CORS (Cross-Origin Resource Sharing), and lacks authentication. This allows an unauthenticated network client or a malicious web page to read files outside the intended directory. Access is limited to JSON files formatted as trajectories, which may contain repository contents, command output, and secrets or API keys.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.