CVE-2026-108592 mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment
Attackers can exfiltrate host environment variables, including API keys, from sandboxed commands due to missing environment clearing in the BubblewrapEnvironment.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-108592?
CVE-2026-108592 is a medium-severity vulnerability in mini-swe-agent, published on 10 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network.
Weakness: CWE-526
Which versions are affected by CVE-2026-108592?
How do I fix CVE-2026-108592?
No fix has been published for CVE-2026-108592 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-108592 being exploited?
There is no known exploitation of CVE-2026-108592 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-p449-r4wm-3hpm.