T02 · Agent Memory Poisoning
Warning
- Location
scripts/log_rejection.sh:4- Finding
Persistent Agent Memory Poisoning Through Unescaped Markdown Log Entries
- Content
View full analysis
"$FILE" fi echo -e "\n## [$ID] $TARGET\n\n**Timestamp**: $TIMESTAMP\n**Decision**: REJECTED\n**Reason**: $REASON\n**Alternative**: $ALT" >> "$FILE" echo "✅ Logged rejection: $ID" ``` ### Technical Analysis The script accepts three caller-controlled arguments and directly appends them to `.learnings/REJECTIONS.md` without validation, encoding, or Markdown escaping. The use of `echo -e` is particularly unsafe because backslash escape sequences in the supplied values may be interpreted. An attacker can therefore inject line breaks, fabricated log entries, Markdown headings, or instruction-like content. The destination is explicitly presented as a learning and audit file. If this file is later loaded into an agent's context or treated as trusted long-term state, injected content may influence future sessions. The vulnerability does not directly execute shell commands because the variables are expanded inside a quoted argument, but it permits persistent content manipulation. ### Attack Path 1. An attacker controls or influences the target, reason, or alternative passed to `log_rejection.sh`. 2. The attacker includes escape sequences and crafted Markdown, such as a fabricated section containing instructions for a future agent. 3. `echo -e` interprets supported escape sequences and appends the resulting content to `.learnings/REJECTIONS.md`. 4. The forged content persists after the script finishes. 5. A later agent or automation process reads the learning file as trusted context. 6. The injected content can ...[truncated 613 chars]- Remediation
View remediation
> "$FILE" ``` The `SANITIZED_*` values must be validated or encoded before this operation. ]]>