CVE-2026-108600 open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink
Attackers can escape the sandbox and write files outside the workspace via dangling symlinks, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-108600?
CVE-2026-108600 is a medium-severity path traversal vulnerability in open-multi-agent, published on 10 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write.
Weakness: CWE-59
Which versions are affected by CVE-2026-108600?
How do I fix CVE-2026-108600?
No fix has been published for CVE-2026-108600 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-108600 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-108600 exists.
Sources
Also known as GHSA-h42w-g3ch-rjjm.