CVE-2026-122235

    Dashboard / Vulnerabilities / CVE-2026-122235

    CVE-2026-122235

    Published: 4 Nov 2026Last Modified: 5 Nov 2026

    Summary: Jan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink

    Details: Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to make the write or edit tools follow symlinks, creating files like ~/.ssh/authorized_keys on the host.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122235.json, https://github.com/janhq/jan/releases/tag/v0.8.8, https://github.com/janhq/jan/security/advisories/GHSA-7j4g-mj5j-p842, https://nvd.nist.gov/vuln/detail/CVE-2026-122235, https://www.vulncheck.com/advisories/jan-0.8.5-before-0.8.8-workspace-guard-bypass-via-dangling-symlink, https://github.com/janhq/jan/commit/840c33e65182ba9975d32f710c5d111e25444b65, https://github.com/janhq/jan/pull/9424, https://github.com/janhq/jan

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 79932ec4f4d2d6e765186b9f0e993f96ae10f16e
    Fixed -a7752d5be16fc5d92df7809def274ffd2b27db07

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-122235 | CVE-DB