potato-annotation

Version	Released
`2.13.1` patch	Oct 29, 2026
`2.13.0` minor	Oct 29, 2026
`2.12.3` patch	Oct 28, 2026
`2.12.2` patch	Oct 28, 2026
`2.12.1` patch	Oct 24, 2026
`2.12.0` minor	Oct 24, 2026
`2.11.1` patch	Oct 15, 2026
`2.11.0` minor	Oct 15, 2026
`2.10.3` patch	Oct 08, 2026
`2.10.2` patch	Oct 07, 2026
`2.10.1` patch	Oct 06, 2026
`2.10.0` minor	Oct 06, 2026
`2.9.4` patch	Sep 23, 2026
`2.9.3` patch	Sep 19, 2026
`2.9.1` patch	Sep 14, 2026
`2.9.0` minor	Sep 13, 2026
`2.8.2` patch	Aug 26, 2026
`2.8.1` patch	Aug 26, 2026
`2.8.0` minor	Aug 18, 2026
`2.7.1` patch	Jul 26, 2026
`2.7.0` minor	Jul 13, 2026
`2.6.2` patch	Jun 24, 2026
`2.6.0` minor	Jun 19, 2026
`2.5.0` minor	May 11, 2026
`2.4.5` patch	May 04, 2026
`2.4.4` patch 1 CVE	Apr 09, 2026
`2.4.3` patch 1 CVE	Apr 09, 2026
`2.4.1` patch 1 CVE	Mar 25, 2026
`2.4.0` minor 1 CVE	Mar 17, 2026
`2.3.0` minor 1 CVE	Mar 08, 2026
`2.2.0` minor 1 CVE	Feb 20, 2026
`2.1.0` minor 1 CVE	Feb 05, 2026
`2.0.2` patch 1 CVE	Feb 02, 2026
`2.0.1` patch 1 CVE	Jan 29, 2026
`2.0.0` major 1 CVE	Jan 29, 2026
`2.0.0rc2` pre	Jan 27, 2026
`2.0.0rc1` pre	Jan 27, 2026
`1.2.2.4` patch	Aug 23, 2024
`1.2.2.3` patch	Apr 09, 2024
`1.2.2.2` patch	Mar 14, 2024
`1.2.2.1` patch	Mar 10, 2024
`1.2.2.0` patch	Mar 05, 2024
`1.2.1.8` patch	Mar 02, 2024
`1.2.1.7` patch	Feb 22, 2024
`1.2.1.6` patch	Feb 14, 2024
`1.2.1.5` patch	Oct 07, 2023
`1.2.1.4` patch	Oct 05, 2023
`1.2.1.3` patch	Oct 03, 2023
`1.2.1.2` patch	Sep 27, 2023
`1.2.1.1` patch	Sep 27, 2023

2.13.1 patch

Oct 29, 2026

2.13.0 minor

Oct 29, 2026

2.12.3 patch

Oct 28, 2026

2.12.2 patch

Oct 28, 2026

2.12.1 patch

Oct 24, 2026

2.12.0 minor

Oct 24, 2026

2.11.1 patch

Oct 15, 2026

2.11.0 minor

Oct 15, 2026

2.10.3 patch

Oct 08, 2026

2.10.2 patch

Oct 07, 2026

2.10.1 patch

Oct 06, 2026

2.10.0 minor

Oct 06, 2026

2.9.4 patch

Sep 23, 2026

2.9.3 patch

Sep 19, 2026

2.9.1 patch

Sep 14, 2026

2.9.0 minor

Sep 13, 2026

2.8.2 patch

Aug 26, 2026

2.8.1 patch

Aug 26, 2026

2.8.0 minor

Aug 18, 2026

2.7.1 patch

Jul 26, 2026

2.7.0 minor

Jul 13, 2026

2.6.2 patch

Jun 24, 2026

2.6.0 minor

Jun 19, 2026

2.5.0 minor

May 11, 2026

2.4.5 patch

May 04, 2026

2.4.4 patch

1 CVE

GHSA-q9m2-fhv9-3jcf May 08, 2026

`potato-annotation` has a Project-Boundary Bypass

5.1 / 10

Medium

Local Low None None Unchanged Low Low None

Summary

validate_path_security uses string-prefix containment (startswith) for boundary checks. This allows paths that are outside the intended project directory but share its prefix string (e.g., /tmp/potato_proj_demo_evil/... vs /tmp/potato_proj_demo) to be accepted.

Details

Affected source location (root cause)

File: potato/server_utils/config_module.py

Snippet (lines 370–373):

real_path = os.path.realpath(normalized_path)
real_base = os.path.realpath(base_dir)
if not real_path.startswith(real_base):
    raise ConfigSecurityError(...)

Snippet (lines 384–389):

real_path = os.path.realpath(normalized_path)
check_dir = project_dir if project_dir else base_dir
real_check_dir = os.path.realpath(check_dir)
if not real_path.startswith(real_check_dir):
    raise ConfigSecurityError(...)

startswith() is string-based, so /tmp/potato_proj_demo_evil/... passes when checked against /tmp/potato_proj_demo.

Confirmed affected call sites

File: potato/server_utils/config_module.py

validate_file_paths task_dir branch (line 2113)

validated_task_dir = validate_path_security(task_dir, project_dir)

validate_file_paths data_files branch (line 2151)

validated_path = validate_path_security(file_path, base_dir, project_dir)

validate_training_config training.data_file branch (line 2286)

validated_path = validate_path_security(data_file, base_dir, project_dir)

PoC

from potato.server_utils.config_module import validate_path_security

base = '/tmp/potato_proj_demo'
vuln = '/tmp/potato_proj_demo_evil/file.txt'

try:
    print('inside=', validate_path_security('/tmp/potato_proj_demo/file.txt', base, base))
except Exception as e:
    print('inside_error=', type(e).__name__, e)

try:
    validate_path_security('/tmp/other_demo/file.txt', base, base)
except Exception as e:
    print('baseline=', type(e).__name__, e)

print('trigger=', validate_path_security(vuln, base, base))

Impact

Can allow unauthorized sibling-prefix file access outside intended project boundary.
Can affect read paths (data_files, training.data_file, base_css, header_logo) and output/path placement depending on configuration.

Affected versions


          2.0.0


          2.0.1


          2.0.2


          2.1.0


          2.2.0


          2.3.0


          2.4.0


          2.4.1


          2.4.3


          2.4.4

Fixed in


          2.4.5

References

Updated May 08, 2026 · Source: OSV.dev

Apr 09, 2026

2.4.3 patch

1 CVE

GHSA-q9m2-fhv9-3jcf May 08, 2026

`potato-annotation` has a Project-Boundary Bypass

5.1 / 10

Medium

Local Low None None Unchanged Low Low None

Summary

validate_path_security uses string-prefix containment (startswith) for boundary checks. This allows paths that are outside the intended project directory but share its prefix string (e.g., /tmp/potato_proj_demo_evil/... vs /tmp/potato_proj_demo) to be accepted.

Details

Affected source location (root cause)

File: potato/server_utils/config_module.py

Snippet (lines 370–373):

real_path = os.path.realpath(normalized_path)
real_base = os.path.realpath(base_dir)
if not real_path.startswith(real_base):
    raise ConfigSecurityError(...)

Snippet (lines 384–389):

real_path = os.path.realpath(normalized_path)
check_dir = project_dir if project_dir else base_dir
real_check_dir = os.path.realpath(check_dir)
if not real_path.startswith(real_check_dir):
    raise ConfigSecurityError(...)

startswith() is string-based, so /tmp/potato_proj_demo_evil/... passes when checked against /tmp/potato_proj_demo.

Confirmed affected call sites

File: potato/server_utils/config_module.py

validate_file_paths task_dir branch (line 2113)

validated_task_dir = validate_path_security(task_dir, project_dir)

validate_file_paths data_files branch (line 2151)

validated_path = validate_path_security(file_path, base_dir, project_dir)

validate_training_config training.data_file branch (line 2286)

validated_path = validate_path_security(data_file, base_dir, project_dir)

PoC

from potato.server_utils.config_module import validate_path_security

base = '/tmp/potato_proj_demo'
vuln = '/tmp/potato_proj_demo_evil/file.txt'

try:
    print('inside=', validate_path_security('/tmp/potato_proj_demo/file.txt', base, base))
except Exception as e:
    print('inside_error=', type(e).__name__, e)

try:
    validate_path_security('/tmp/other_demo/file.txt', base, base)
except Exception as e:
    print('baseline=', type(e).__name__, e)

print('trigger=', validate_path_security(vuln, base, base))

Impact

Can allow unauthorized sibling-prefix file access outside intended project boundary.
Can affect read paths (data_files, training.data_file, base_css, header_logo) and output/path placement depending on configuration.

Affected versions


          2.0.0


          2.0.1


          2.0.2


          2.1.0


          2.2.0


          2.3.0


          2.4.0


          2.4.1


          2.4.3


          2.4.4

Fixed in


          2.4.5

References

Updated May 08, 2026 · Source: OSV.dev

Apr 09, 2026

2.4.1 patch

1 CVE

GHSA-q9m2-fhv9-3jcf May 08, 2026

`potato-annotation` has a Project-Boundary Bypass

5.1 / 10

Medium

Local Low None None Unchanged Low Low None

Summary

validate_path_security uses string-prefix containment (startswith) for boundary checks. This allows paths that are outside the intended project directory but share its prefix string (e.g., /tmp/potato_proj_demo_evil/... vs /tmp/potato_proj_demo) to be accepted.

Details

Affected source location (root cause)

File: potato/server_utils/config_module.py

Snippet (lines 370–373):

real_path = os.path.realpath(normalized_path)
real_base = os.path.realpath(base_dir)
if not real_path.startswith(real_base):
    raise ConfigSecurityError(...)

Snippet (lines 384–389):

real_path = os.path.realpath(normalized_path)
check_dir = project_dir if project_dir else base_dir
real_check_dir = os.path.realpath(check_dir)
if not real_path.startswith(real_check_dir):
    raise ConfigSecurityError(...)

startswith() is string-based, so /tmp/potato_proj_demo_evil/... passes when checked against /tmp/potato_proj_demo.

Confirmed affected call sites

File: potato/server_utils/config_module.py

validate_file_paths task_dir branch (line 2113)

validated_task_dir = validate_path_security(task_dir, project_dir)

validate_file_paths data_files branch (line 2151)

validated_path = validate_path_security(file_path, base_dir, project_dir)

validate_training_config training.data_file branch (line 2286)

validated_path = validate_path_security(data_file, base_dir, project_dir)

PoC

from potato.server_utils.config_module import validate_path_security

base = '/tmp/potato_proj_demo'
vuln = '/tmp/potato_proj_demo_evil/file.txt'

try:
    print('inside=', validate_path_security('/tmp/potato_proj_demo/file.txt', base, base))
except Exception as e:
    print('inside_error=', type(e).__name__, e)

try:
    validate_path_security('/tmp/other_demo/file.txt', base, base)
except Exception as e:
    print('baseline=', type(e).__name__, e)

print('trigger=', validate_path_security(vuln, base, base))

Impact

Can allow unauthorized sibling-prefix file access outside intended project boundary.
Can affect read paths (data_files, training.data_file, base_css, header_logo) and output/path placement depending on configuration.

Affected versions


          2.0.0


          2.0.1


          2.0.2


          2.1.0


          2.2.0


          2.3.0


          2.4.0


          2.4.1


          2.4.3


          2.4.4

Fixed in


          2.4.5

References

Updated May 08, 2026 · Source: OSV.dev

Mar 25, 2026

2.4.0 minor

1 CVE

GHSA-q9m2-fhv9-3jcf May 08, 2026

`potato-annotation` has a Project-Boundary Bypass

5.1 / 10

Medium

Local Low None None Unchanged Low Low None

Summary

validate_path_security uses string-prefix containment (startswith) for boundary checks. This allows paths that are outside the intended project directory but share its prefix string (e.g., /tmp/potato_proj_demo_evil/... vs /tmp/potato_proj_demo) to be accepted.

Details

Affected source location (root cause)

File: potato/server_utils/config_module.py

Snippet (lines 370–373):

real_path = os.path.realpath(normalized_path)
real_base = os.path.realpath(base_dir)
if not real_path.startswith(real_base):
    raise ConfigSecurityError(...)

Snippet (lines 384–389):

real_path = os.path.realpath(normalized_path)
check_dir = project_dir if project_dir else base_dir
real_check_dir = os.path.realpath(check_dir)
if not real_path.startswith(real_check_dir):
    raise ConfigSecurityError(...)

startswith() is string-based, so /tmp/potato_proj_demo_evil/... passes when checked against /tmp/potato_proj_demo.

Confirmed affected call sites

File: potato/server_utils/config_module.py

validate_file_paths task_dir branch (line 2113)

validated_task_dir = validate_path_security(task_dir, project_dir)

validate_file_paths data_files branch (line 2151)

validated_path = validate_path_security(file_path, base_dir, project_dir)

validate_training_config training.data_file branch (line 2286)

validated_path = validate_path_security(data_file, base_dir, project_dir)

PoC

from potato.server_utils.config_module import validate_path_security

base = '/tmp/potato_proj_demo'
vuln = '/tmp/potato_proj_demo_evil/file.txt'

try:
    print('inside=', validate_path_security('/tmp/potato_proj_demo/file.txt', base, base))
except Exception as e:
    print('inside_error=', type(e).__name__, e)

try:
    validate_path_security('/tmp/other_demo/file.txt', base, base)
except Exception as e:
    print('baseline=', type(e).__name__, e)

print('trigger=', validate_path_security(vuln, base, base))

Impact

Can allow unauthorized sibling-prefix file access outside intended project boundary.
Can affect read paths (data_files, training.data_file, base_css, header_logo) and output/path placement depending on configuration.

Affected versions


          2.0.0


          2.0.1


          2.0.2


          2.1.0


          2.2.0


          2.3.0


          2.4.0


          2.4.1


          2.4.3


          2.4.4

Fixed in


          2.4.5

References

Updated May 08, 2026 · Source: OSV.dev

Mar 17, 2026

2.3.0 minor

1 CVE

GHSA-q9m2-fhv9-3jcf May 08, 2026

`potato-annotation` has a Project-Boundary Bypass

5.1 / 10

Medium

Local Low None None Unchanged Low Low None

Summary

validate_path_security uses string-prefix containment (startswith) for boundary checks. This allows paths that are outside the intended project directory but share its prefix string (e.g., /tmp/potato_proj_demo_evil/... vs /tmp/potato_proj_demo) to be accepted.

Details

Affected source location (root cause)

File: potato/server_utils/config_module.py

Snippet (lines 370–373):

real_path = os.path.realpath(normalized_path)
real_base = os.path.realpath(base_dir)
if not real_path.startswith(real_base):
    raise ConfigSecurityError(...)

Snippet (lines 384–389):

real_path = os.path.realpath(normalized_path)
check_dir = project_dir if project_dir else base_dir
real_check_dir = os.path.realpath(check_dir)
if not real_path.startswith(real_check_dir):
    raise ConfigSecurityError(...)

startswith() is string-based, so /tmp/potato_proj_demo_evil/... passes when checked against /tmp/potato_proj_demo.

Confirmed affected call sites

File: potato/server_utils/config_module.py

validate_file_paths task_dir branch (line 2113)

validated_task_dir = validate_path_security(task_dir, project_dir)

validate_file_paths data_files branch (line 2151)

validated_path = validate_path_security(file_path, base_dir, project_dir)

validate_training_config training.data_file branch (line 2286)

validated_path = validate_path_security(data_file, base_dir, project_dir)

PoC

from potato.server_utils.config_module import validate_path_security

base = '/tmp/potato_proj_demo'
vuln = '/tmp/potato_proj_demo_evil/file.txt'

try:
    print('inside=', validate_path_security('/tmp/potato_proj_demo/file.txt', base, base))
except Exception as e:
    print('inside_error=', type(e).__name__, e)

try:
    validate_path_security('/tmp/other_demo/file.txt', base, base)
except Exception as e:
    print('baseline=', type(e).__name__, e)

print('trigger=', validate_path_security(vuln, base, base))

Impact

Can allow unauthorized sibling-prefix file access outside intended project boundary.
Can affect read paths (data_files, training.data_file, base_css, header_logo) and output/path placement depending on configuration.

Affected versions


          2.0.0


          2.0.1


          2.0.2


          2.1.0


          2.2.0


          2.3.0


          2.4.0


          2.4.1


          2.4.3


          2.4.4

Fixed in


          2.4.5

References

Updated May 08, 2026 · Source: OSV.dev

Mar 08, 2026

2.2.0 minor

1 CVE

GHSA-q9m2-fhv9-3jcf May 08, 2026

`potato-annotation` has a Project-Boundary Bypass

5.1 / 10

Medium

Local Low None None Unchanged Low Low None

Summary

validate_path_security uses string-prefix containment (startswith) for boundary checks. This allows paths that are outside the intended project directory but share its prefix string (e.g., /tmp/potato_proj_demo_evil/... vs /tmp/potato_proj_demo) to be accepted.

Details

Affected source location (root cause)

File: potato/server_utils/config_module.py

Snippet (lines 370–373):

real_path = os.path.realpath(normalized_path)
real_base = os.path.realpath(base_dir)
if not real_path.startswith(real_base):
    raise ConfigSecurityError(...)

Snippet (lines 384–389):

real_path = os.path.realpath(normalized_path)
check_dir = project_dir if project_dir else base_dir
real_check_dir = os.path.realpath(check_dir)
if not real_path.startswith(real_check_dir):
    raise ConfigSecurityError(...)

startswith() is string-based, so /tmp/potato_proj_demo_evil/... passes when checked against /tmp/potato_proj_demo.

Confirmed affected call sites

File: potato/server_utils/config_module.py

validate_file_paths task_dir branch (line 2113)

validated_task_dir = validate_path_security(task_dir, project_dir)

validate_file_paths data_files branch (line 2151)

validated_path = validate_path_security(file_path, base_dir, project_dir)

validate_training_config training.data_file branch (line 2286)

validated_path = validate_path_security(data_file, base_dir, project_dir)

PoC

from potato.server_utils.config_module import validate_path_security

base = '/tmp/potato_proj_demo'
vuln = '/tmp/potato_proj_demo_evil/file.txt'

try:
    print('inside=', validate_path_security('/tmp/potato_proj_demo/file.txt', base, base))
except Exception as e:
    print('inside_error=', type(e).__name__, e)

try:
    validate_path_security('/tmp/other_demo/file.txt', base, base)
except Exception as e:
    print('baseline=', type(e).__name__, e)

print('trigger=', validate_path_security(vuln, base, base))

Impact

Can allow unauthorized sibling-prefix file access outside intended project boundary.
Can affect read paths (data_files, training.data_file, base_css, header_logo) and output/path placement depending on configuration.

Affected versions


          2.0.0


          2.0.1


          2.0.2


          2.1.0


          2.2.0


          2.3.0


          2.4.0


          2.4.1


          2.4.3


          2.4.4

Fixed in


          2.4.5

References

Updated May 08, 2026 · Source: OSV.dev

Feb 20, 2026

2.1.0 minor

1 CVE

GHSA-q9m2-fhv9-3jcf May 08, 2026

`potato-annotation` has a Project-Boundary Bypass

5.1 / 10

Medium

Local Low None None Unchanged Low Low None

Summary

validate_path_security uses string-prefix containment (startswith) for boundary checks. This allows paths that are outside the intended project directory but share its prefix string (e.g., /tmp/potato_proj_demo_evil/... vs /tmp/potato_proj_demo) to be accepted.

Details

Affected source location (root cause)

File: potato/server_utils/config_module.py

Snippet (lines 370–373):

real_path = os.path.realpath(normalized_path)
real_base = os.path.realpath(base_dir)
if not real_path.startswith(real_base):
    raise ConfigSecurityError(...)

Snippet (lines 384–389):

real_path = os.path.realpath(normalized_path)
check_dir = project_dir if project_dir else base_dir
real_check_dir = os.path.realpath(check_dir)
if not real_path.startswith(real_check_dir):
    raise ConfigSecurityError(...)

startswith() is string-based, so /tmp/potato_proj_demo_evil/... passes when checked against /tmp/potato_proj_demo.

Confirmed affected call sites

File: potato/server_utils/config_module.py

validate_file_paths task_dir branch (line 2113)

validated_task_dir = validate_path_security(task_dir, project_dir)

validate_file_paths data_files branch (line 2151)

validated_path = validate_path_security(file_path, base_dir, project_dir)

validate_training_config training.data_file branch (line 2286)

validated_path = validate_path_security(data_file, base_dir, project_dir)

PoC

from potato.server_utils.config_module import validate_path_security

base = '/tmp/potato_proj_demo'
vuln = '/tmp/potato_proj_demo_evil/file.txt'

try:
    print('inside=', validate_path_security('/tmp/potato_proj_demo/file.txt', base, base))
except Exception as e:
    print('inside_error=', type(e).__name__, e)

try:
    validate_path_security('/tmp/other_demo/file.txt', base, base)
except Exception as e:
    print('baseline=', type(e).__name__, e)

print('trigger=', validate_path_security(vuln, base, base))

Impact

Can allow unauthorized sibling-prefix file access outside intended project boundary.
Can affect read paths (data_files, training.data_file, base_css, header_logo) and output/path placement depending on configuration.

Affected versions


          2.0.0


          2.0.1


          2.0.2


          2.1.0


          2.2.0


          2.3.0


          2.4.0


          2.4.1


          2.4.3


          2.4.4

Fixed in


          2.4.5

References

Updated May 08, 2026 · Source: OSV.dev

Feb 05, 2026

2.0.2 patch

1 CVE

GHSA-q9m2-fhv9-3jcf May 08, 2026

`potato-annotation` has a Project-Boundary Bypass

5.1 / 10

Medium

Local Low None None Unchanged Low Low None

Summary

validate_path_security uses string-prefix containment (startswith) for boundary checks. This allows paths that are outside the intended project directory but share its prefix string (e.g., /tmp/potato_proj_demo_evil/... vs /tmp/potato_proj_demo) to be accepted.

Details

Affected source location (root cause)

File: potato/server_utils/config_module.py

Snippet (lines 370–373):

real_path = os.path.realpath(normalized_path)
real_base = os.path.realpath(base_dir)
if not real_path.startswith(real_base):
    raise ConfigSecurityError(...)

Snippet (lines 384–389):

real_path = os.path.realpath(normalized_path)
check_dir = project_dir if project_dir else base_dir
real_check_dir = os.path.realpath(check_dir)
if not real_path.startswith(real_check_dir):
    raise ConfigSecurityError(...)

startswith() is string-based, so /tmp/potato_proj_demo_evil/... passes when checked against /tmp/potato_proj_demo.

Confirmed affected call sites

File: potato/server_utils/config_module.py

validate_file_paths task_dir branch (line 2113)

validated_task_dir = validate_path_security(task_dir, project_dir)

validate_file_paths data_files branch (line 2151)

validated_path = validate_path_security(file_path, base_dir, project_dir)

validate_training_config training.data_file branch (line 2286)

validated_path = validate_path_security(data_file, base_dir, project_dir)

PoC

from potato.server_utils.config_module import validate_path_security

base = '/tmp/potato_proj_demo'
vuln = '/tmp/potato_proj_demo_evil/file.txt'

try:
    print('inside=', validate_path_security('/tmp/potato_proj_demo/file.txt', base, base))
except Exception as e:
    print('inside_error=', type(e).__name__, e)

try:
    validate_path_security('/tmp/other_demo/file.txt', base, base)
except Exception as e:
    print('baseline=', type(e).__name__, e)

print('trigger=', validate_path_security(vuln, base, base))

Impact

Can allow unauthorized sibling-prefix file access outside intended project boundary.
Can affect read paths (data_files, training.data_file, base_css, header_logo) and output/path placement depending on configuration.

Affected versions


          2.0.0


          2.0.1


          2.0.2


          2.1.0


          2.2.0


          2.3.0


          2.4.0


          2.4.1


          2.4.3


          2.4.4

Fixed in


          2.4.5

References

Updated May 08, 2026 · Source: OSV.dev

Feb 02, 2026

2.0.1 patch

1 CVE

GHSA-q9m2-fhv9-3jcf May 08, 2026

`potato-annotation` has a Project-Boundary Bypass

5.1 / 10

Medium

Local Low None None Unchanged Low Low None

Summary

validate_path_security uses string-prefix containment (startswith) for boundary checks. This allows paths that are outside the intended project directory but share its prefix string (e.g., /tmp/potato_proj_demo_evil/... vs /tmp/potato_proj_demo) to be accepted.

Details

Affected source location (root cause)

File: potato/server_utils/config_module.py

Snippet (lines 370–373):

real_path = os.path.realpath(normalized_path)
real_base = os.path.realpath(base_dir)
if not real_path.startswith(real_base):
    raise ConfigSecurityError(...)

Snippet (lines 384–389):

real_path = os.path.realpath(normalized_path)
check_dir = project_dir if project_dir else base_dir
real_check_dir = os.path.realpath(check_dir)
if not real_path.startswith(real_check_dir):
    raise ConfigSecurityError(...)

startswith() is string-based, so /tmp/potato_proj_demo_evil/... passes when checked against /tmp/potato_proj_demo.

Confirmed affected call sites

File: potato/server_utils/config_module.py

validate_file_paths task_dir branch (line 2113)

validated_task_dir = validate_path_security(task_dir, project_dir)

validate_file_paths data_files branch (line 2151)

validated_path = validate_path_security(file_path, base_dir, project_dir)

validate_training_config training.data_file branch (line 2286)

validated_path = validate_path_security(data_file, base_dir, project_dir)

PoC

from potato.server_utils.config_module import validate_path_security

base = '/tmp/potato_proj_demo'
vuln = '/tmp/potato_proj_demo_evil/file.txt'

try:
    print('inside=', validate_path_security('/tmp/potato_proj_demo/file.txt', base, base))
except Exception as e:
    print('inside_error=', type(e).__name__, e)

try:
    validate_path_security('/tmp/other_demo/file.txt', base, base)
except Exception as e:
    print('baseline=', type(e).__name__, e)

print('trigger=', validate_path_security(vuln, base, base))

Impact

Can allow unauthorized sibling-prefix file access outside intended project boundary.
Can affect read paths (data_files, training.data_file, base_css, header_logo) and output/path placement depending on configuration.

Affected versions


          2.0.0


          2.0.1


          2.0.2


          2.1.0


          2.2.0


          2.3.0


          2.4.0


          2.4.1


          2.4.3


          2.4.4

Fixed in


          2.4.5

References

Updated May 08, 2026 · Source: OSV.dev

Jan 29, 2026

2.0.0 major

1 CVE

GHSA-q9m2-fhv9-3jcf May 08, 2026

`potato-annotation` has a Project-Boundary Bypass

5.1 / 10

Medium

Local Low None None Unchanged Low Low None

Summary

validate_path_security uses string-prefix containment (startswith) for boundary checks. This allows paths that are outside the intended project directory but share its prefix string (e.g., /tmp/potato_proj_demo_evil/... vs /tmp/potato_proj_demo) to be accepted.

Details

Affected source location (root cause)

File: potato/server_utils/config_module.py

Snippet (lines 370–373):

real_path = os.path.realpath(normalized_path)
real_base = os.path.realpath(base_dir)
if not real_path.startswith(real_base):
    raise ConfigSecurityError(...)

Snippet (lines 384–389):

real_path = os.path.realpath(normalized_path)
check_dir = project_dir if project_dir else base_dir
real_check_dir = os.path.realpath(check_dir)
if not real_path.startswith(real_check_dir):
    raise ConfigSecurityError(...)

startswith() is string-based, so /tmp/potato_proj_demo_evil/... passes when checked against /tmp/potato_proj_demo.

Confirmed affected call sites

File: potato/server_utils/config_module.py

validate_file_paths task_dir branch (line 2113)

validated_task_dir = validate_path_security(task_dir, project_dir)

validate_file_paths data_files branch (line 2151)

validated_path = validate_path_security(file_path, base_dir, project_dir)

validate_training_config training.data_file branch (line 2286)

validated_path = validate_path_security(data_file, base_dir, project_dir)

PoC

from potato.server_utils.config_module import validate_path_security

base = '/tmp/potato_proj_demo'
vuln = '/tmp/potato_proj_demo_evil/file.txt'

try:
    print('inside=', validate_path_security('/tmp/potato_proj_demo/file.txt', base, base))
except Exception as e:
    print('inside_error=', type(e).__name__, e)

try:
    validate_path_security('/tmp/other_demo/file.txt', base, base)
except Exception as e:
    print('baseline=', type(e).__name__, e)

print('trigger=', validate_path_security(vuln, base, base))

Impact

Can allow unauthorized sibling-prefix file access outside intended project boundary.
Can affect read paths (data_files, training.data_file, base_css, header_logo) and output/path placement depending on configuration.

Affected versions


          2.0.0


          2.0.1


          2.0.2


          2.1.0


          2.2.0


          2.3.0


          2.4.0


          2.4.1


          2.4.3


          2.4.4

Fixed in


          2.4.5

References

Updated May 08, 2026 · Source: OSV.dev

Jan 29, 2026

2.0.0rc2 pre

Jan 27, 2026

2.0.0rc1 pre

Jan 27, 2026

1.2.2.4 patch

Aug 23, 2024

1.2.2.3 patch

Apr 09, 2024

1.2.2.2 patch

Mar 14, 2024

1.2.2.1 patch

Mar 10, 2024

1.2.2.0 patch

Mar 05, 2024

1.2.1.8 patch

Mar 02, 2024

1.2.1.7 patch

Feb 22, 2024

1.2.1.6 patch

Feb 14, 2024

1.2.1.5 patch

Oct 07, 2023

1.2.1.4 patch

Oct 05, 2023

1.2.1.3 patch

Oct 03, 2023

1.2.1.2 patch

Sep 27, 2023

1.2.1.1 patch

Sep 27, 2023

Activity

Reach

Details