{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-111045 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-111045 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-111045 is a high-severity path traversal vulnerability in anshupriyan cli-bridge, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-111045 and fix it if it is affected.\n\nWhat it is: CVE-2026-111045 is a high-severity path traversal vulnerability in anshupriyan cli-bridge, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-111045 in the wild and no public exploit code.\n\nAffected product: anshupriyan cli-bridge. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-111045/ (Markdown: https://insights.sbomify.com/CVE-2026-111045/index.md)","id":"CVE-2026-111045","markdown":"https://insights.sbomify.com/CVE-2026-111045/index.md","name":"CVE-2026-111045","record":{"aliases":["GHSA-8jc4-x8v7-2q9r"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_modify","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"CLI Bridge library","requires_auth":"none","summary":"An attacker can escape the workspace sandbox and write arbitrary files outside the root directory by exploiting a dangling symlink vulnerability in CLI Bridge.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-59","name":"Improper Link Resolution Before File Access"}],"description":"CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path as safe, so write_file follows the link and can write arbitrary files outside the workspace root. This issue is fixed in version 0.0.2.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"CLI Bridge: High-severity sandbox escape via dangling symlink","id":"CVE-2026-111045","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions","id":"CVE-2026-111046"},"packages":[],"prev":{"headline":"Disabled Sunshine clients can bypass revocation with a derived client certificate","id":"CVE-2026-111044"},"products":["cli-bridge"],"published":"2026-10-19","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["anshupriyan"]},"summary":"An attacker can escape the workspace sandbox and write arbitrary files outside the root directory by exploiting a dangling symlink vulnerability in CLI Bridge.","url":"https://insights.sbomify.com/CVE-2026-111045/"}