CVE-2023-43803: 
Arduino Create Agent vulnerability analysis and mitigation

Arduino Create Agent, a package designed to help manage Arduino development, contains a vulnerability (CVE-2023-43803) affecting the endpoint /v2/pkgs/tools/installed and its handling of plugin names supplied as user input. The vulnerability was discovered and disclosed in October 2023, affecting versions prior to 1.3.3 (GitHub Advisory, NVD).

The vulnerability is classified as a Path Traversal (CWE-22) issue with a CVSS v3.1 Base Score of 6.1 (MEDIUM) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. The vulnerability specifically affects how the endpoint handles plugin names in user input, allowing potential manipulation of file paths (Nozomi Networks).

When exploited, the vulnerability allows a user with access to the localhost interface or ability to bypass CORS configuration to delete arbitrary files or folders belonging to the user running the Arduino Create Agent through crafted HTTP POST requests. This can lead to the deletion of protected resources if the vulnerable agent is running with elevated privileges (GitHub Advisory, Nozomi Networks).

The vulnerability has been patched in Arduino Create Agent version 1.3.3. Users are strongly advised to upgrade to this version as there are no known workarounds for this vulnerability (GitHub Advisory, GitHub Release).