CVE-2026-85690

Plandex, an AI coding tool whose ApplyFiles function writes file changes generated by a language model, contains a path traversal vulnerability (CWE-22) in version 2.2.1 that fails to confine writes to the project directory. An attacker who can poison files in a repository the tool operates on, or supply attacker-controlled context, can influence the model's output so that ApplyFiles writes to arbitrary filesystem locations such as shell rc files or cron files. By planting a malicious shell rc or cron entry, the attacker achieves code execution on the host running Plandex. Any user running Plandex 2.2.1 against untrusted repositories or context is affected, and the CVSS 4.0 vector (AV:L, UI:P) indicates exploitation requires this kind of influence over the tool's inputs plus user interaction rather than direct remote access. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

What to do: Upgrade to a patched Plandex release newer than 2.2.1 as soon as one is published (the fixed version is not specified in the available data). Until then, treat AI-proposed file paths as untrusted when running Plandex against untrusted repositories, and audit shell rc files and cron entries on affected hosts for unexpected modifications.