`potato-annotation` has a Project-Boundary Bypass
Summary
validate_path_security uses string-prefix containment (startswith) for boundary checks. This allows paths that are outside the intended project directory but share its prefix string (e.g., /tmp/potato_proj_demo_evil/... vs /tmp/potato_proj_demo) to be accepted.
Details
Affected source location (root cause)
File: potato/server_utils/config_module.py
Snippet (lines 370–373):
real_path = os.path.realpath(normalized_path)
real_base = os.path.realpath(base_dir)
if not real_path.startswith(real_base):
raise ConfigSecurityError(...)Snippet (lines 384–389):
real_path = os.path.realpath(normalized_path)
check_dir = project_dir if project_dir else base_dir
real_check_dir = os.path.realpath(check_dir)
if not real_path.startswith(real_check_dir):
raise ConfigSecurityError(...)startswith() is string-based, so /tmp/potato_proj_demo_evil/... passes when checked against /tmp/potato_proj_demo.
Confirmed affected call sites
File: potato/server_utils/config_module.py
validate_file_pathstask_dir branch (line 2113)
validated_task_dir = validate_path_security(task_dir, project_dir)validate_file_pathsdata_files branch (line 2151)
validated_path = validate_path_security(file_path, base_dir, project_dir)validate_training_configtraining.data_file branch (line 2286)
validated_path = validate_path_security(data_file, base_dir, project_dir)PoC
from potato.server_utils.config_module import validate_path_security
base = '/tmp/potato_proj_demo'
vuln = '/tmp/potato_proj_demo_evil/file.txt'
try:
print('inside=', validate_path_security('/tmp/potato_proj_demo/file.txt', base, base))
except Exception as e:
print('inside_error=', type(e).__name__, e)
try:
validate_path_security('/tmp/other_demo/file.txt', base, base)
except Exception as e:
print('baseline=', type(e).__name__, e)
print('trigger=', validate_path_security(vuln, base, base))Impact
- Can allow unauthorized sibling-prefix file access outside intended project boundary.
- Can affect read paths (
data_files,training.data_file,base_css,header_logo) and output/path placement depending on configuration.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | potato-annotation | >= 2.0.0, < 2.4.5 | 2.4.5 |
References
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N- Weakness (CWE)
CWE-22- Platform
- Python (PyPI)
- Package
potato-annotation- Disclosed
- 08.05.2026
- Updated
- 11.10.2026 12:19
Sources and licenses
OSV / GitHub Advisory Database - GHSA-q9m2-fhv9-3jcf - CC BY 4.0
Vulnerability history: potato-annotation
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.