{"action":"Upgrade local-operator to 0.47.5 or later.","affected":[{"fixed":"0.47.5","introduced":"0"}],"component":"local-operator","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.47.5"],"ghsa_id":"GHSA-22mg-8gw7-636x","id":"tcs_01M5KH983RKCPTDEGATZ3TD0G2","modified_at":"2026-09-30T16:46:03.260718926Z","published_at":"2026-09-05T07:43:59Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4009","https://github.com/damianvtran/local-operator/security/advisories/GHSA-22mg-8gw7-636x","https://github.com/damianvtran/local-operator/pull/643","https://github.com/damianvtran/local-operator/commit/29fc4c68a3ed1d238b8abf6b6a6136a3361416a5","https://github.com/damianvtran/local-operator/releases/tag/v0.47.5","https://pypi.org/project/local-operator/"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-4009","url":"https://osv.dev/vulnerability/PYSEC-2026-4009"}],"summary":"Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator"}