Skip to content

Some text is shown in its original language while the English translation is being prepared.

EventUpdating

open-multi-agent tool sandbox symlink escape vulnerability

1 reports1 reporting sourcesLatest report

Start here

AI overview

NVD published CVE-2026-108600, noting that open-multi-agent's file write tool can write files outside the workspace via dangling symbolic links. According to VulnCheck's advisory, affected versions are 1.5.0 through 1.21.2. The NVD page references list the relevant code locations in file-write.ts and path-safety.ts in the repository, as well as a HackMD vulnerability analysis.

Generated by AI from reports · Updated 17 hr ago

Latest update
open-multi-agent 悬空符号链接可写出工作区

Progress timeline

Oct 10
  1. NIST NVD
    open-multi-agent 悬空符号链接可写出工作区

    NVD published CVE-2026-108600, noting that open-multi-agent's file write tool can write files outside the workspace via dangling symbolic links. According to VulnCheck's advisory, affected versions are 1.5.0 through 1.21.2. The NVD page references list the relevant code locations in file-write.ts and path-safety.ts in the repository, as well as a HackMD vulnerability analysis.

Related discussion

No discussion links have been collected for this event yet.

Attention trend

New sources per day

1 days total1 ·Maximum1（Oct 12）·Today1

  • Oct 12New1 sources (1 outlets,0 accounts)

Hourly attention

Current attention38·Peak in the comparable period55（Oct 12 02:00）·Change over the comparable past 24 hours –

0204060Oct12Oct12Oct12Oct12