CVE-2026-122235
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
36/100
Published: 2026-11-04
Modified: 2026-11-12
First seen: 2026-11-04
Status: active
Attack Surface
Low Complexity
No Auth
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
Passive
S:
X
AT:
Present
VC:
None
VI:
High
VA:
None
Description
Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to make the write or edit tools follow symlinks, creating files like ~/.ssh/authorized_keys on the host.