mini-swe-agent CVE-2026-108592

Exploitation requires three concrete conditions all drawn from the description: (1) the deployment must use BubblewrapEnvironment (the bwrap-based sandbox), which is the specific component that omits --clearenv; (2) sensitive secrets such as API keys must actually be present in the host environment that bwrap inherits; and (3) attacker-controlled text must reach the agent as processed task content so that a prompt-injection payload can direct it to read and exfiltrate those variables (matching AT:P and UI:P in the CVSS 4.0 vector). Limiting factors: deployments not using the Bubblewrap sandbox, or that run the agent without real secrets in its environment, or that never feed it untrusted content, are not exploitable; outbound network egress from the sandbox is also needed for exfiltration.

This is a moderate, context-dependent risk rather than a drop-everything priority. The CVSS 4.0 base score of 6.0 is driven by network attack vector (AV:N) and high confidentiality impact (VC:H - leaked API keys), but it is meaningfully constrained by AT:P (a specific attack requirement: attacker-controlled content must reach the agent) and UI:P (the victim must run the agent against that content). No EPSS score was provided in the input, and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation - treat exploitation status as 'no public exploit identified at time of analysis.' A detailed technical write-up exists (hackmd) and the vulnerable code region is pinpointed in the vendor repository, which lowers the research barrier for an attacker even though no packaged exploit is confirmed. The signals are internally consistent (there is no network-vs-local contradiction), but note one nuance: PR:N labels this 'unauthenticated,' yet real-world exploitation still hinges on an operator choosing to run the agent on untrusted task content under the Bubblewrap sandbox - so the unauthenticated label overstates how opportunistically this can be triggered. Net: prioritize for anyone running mini-swe-agent's BubblewrapEnvironment with real secrets in the host environment, but it is not a mass-exploitation internet-facing threat.

An operator runs mini-swe-agent (1.10.0-2.4.6) using BubblewrapEnvironment to triage an issue, PR, or document that contains attacker-planted instructions. Because bwrap is launched without --clearenv, the sandboxed shell inherits the host's environment including API keys; the injected prompt steers the agent to read those variables and POST them to an attacker-controlled endpoint over the shared network. No packaged public exploit is identified, but a public technical write-up and the exact vulnerable source lines are available.