CLI Bridge CVE-2026-111045

Requires anshupriyan cli-bridge prior to 0.0.2 running as an MCP filesystem server with a configured WORKSPACE_ROOT. The attacker must be able to invoke the write_file tool and target a path that is a dangling symlink whose target does not exist (so fs.realpathSync throws ENOENT, triggering the vulnerable parent-only fallback) and which points outside the workspace root. Limiting factors: exploitation depends on the ability to place or reference such a symlink inside the workspace and to drive the write_file tool (typically via the LLM agent or local access), and the writing process runs with the invoking user's privileges, so impact is bounded by that user's filesystem permissions rather than true remote unauthenticated reach.

The input assigns CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), rating this a network, unauthenticated, no-interaction integrity-only flaw. That network/unauthenticated framing conflicts with the actual nature of the product: CLI Bridge is a local Model Context Protocol (MCP) server (configured in Claude Desktop and Qwen Studio per the README) that exposes a write_file tool over a local stdio transport, so real exploitation is local/tool-mediated rather than remotely reachable over a network socket - verify the AV:N rating with the vendor, as AV:L is more defensible. The weakness (CWE-59, link following) is concrete and confirmed by the patch: resolveSafePath falls back to only resolving the parent directory when fs.realpathSync throws ENOENT on a dangling symlink target, returning the symlink path as 'safe' so write_file escapes the workspace root. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a genuine sandbox-escape bug worth patching, but its real-world priority is limited by an obscure, tiny-footprint product and the need for attacker influence over the MCP tool's input rather than true remote unauthenticated reach - the raw 7.5 overstates practical urgency.

An actor able to influence the MCP client's tool calls (for example via content/prompt injection into the agent driving CLI Bridge, or with local access to seed a symlink in the workspace) requests write_file against a path that is a dangling symlink pointing outside the workspace root. Because the symlink target does not exist, realpathSync throws ENOENT and the vulnerable fallback approves the path, causing the server to write attacker-controlled content to an arbitrary location such as a startup script or configuration file. No public exploit code is identified at time of analysis, and exploitation is low-complexity once the write_file tool can be invoked.