CVE-2026-5597

CVE-2026-5597 is a path traversal vulnerability affecting griptape-ai griptape version 0.19.4, specifically within the ComputerTool component located in griptape/tools/computer/tool.py. The flaw allows an attacker to manipulate the filename argument to traverse the file system and access unintended files or directories. The vulnerability carries a CVSS score of 6.3 (Medium severity) and is remotely exploitable with low attack complexity. Authentication is required as it necessitates user privileges, but successful exploitation could result in limited confidentiality, integrity, and availability impacts. The attack requires only network access and no user interaction. Exploit code has been publicly disclosed, though the vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. The vendor was notified early but provided no response. Community attention remains minimal as indicated by the low EPSS score of 0.00024, suggesting this vulnerability poses a relatively contained risk at present.