open-multi-agent CVE-2026-108600

Exploitation requires two concrete preconditions working together: (1) the attacker must be able to plant a dangling symlink inside the agent's workspace directory, and (2) the attacker must have prompt-injection influence over the agent so its file_write built-in tool is steered to write to that symlink path. Only open-multi-agent/@open-multi-agent/core versions 1.5.0 through 1.21.2 with the file_write tool reachable are affected. Limiting factors: the vector is LOCAL (no remote network exploitation), an operator must actually run the agent against attacker-influenced input (UI:P), and the attacker-present symlink-planting requirement (AT:P) means this is not a default-config, fire-and-forget remote exploit. Impact is bounded to wherever the agent process has write permission.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:P, score 5.7) tells a consistent story with the description: exploitation is LOCAL, requires attacker-present conditions (AT:P - a dangling symlink must already be planted) and passive user interaction (UI:P - an operator must run the agent against attacker-influenced input). Impact is integrity-only (VI:H) with no confidentiality or availability loss and no subsequent-system scope change, which matches a file-write-outside-sandbox primitive rather than direct code execution. No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input, so there is no signal of active or widespread exploitation - the controlling factor is really the AT:P/UI:P precondition chain plus the prompt-injection dependency, which makes this opportunistic/targeted rather than mass-exploitable. The arrow pointing UP on real risk is that the affected component is an autonomous AI agent framework where prompt injection is a realistic and increasingly common delivery vector, and an arbitrary file write by a long-lived agent process can escalate to code execution depending on where it can write. Net: treat as a legitimate sandbox-escape to patch promptly, but its real-world footprint and lack of exploitation evidence keep it below critical.

An attacker who can influence the contents of an agent's workspace plants a dangling symlink there, then delivers a prompt-injection payload (e.g., through a document, issue, or data source the agent processes) that steers the agent's file_write tool to write to the symlink's path. Because the sandbox path-safety check fails to resolve dangling links, the write lands outside the workspace root - anywhere the agent process can write - enabling overwrite of configuration, scripts, or startup files. No public exploit was identified at time of analysis, though a detailed technical write-up (hackmd) and vulnerable source lines are referenced.