Entire CLI CVE-2026-57208

Three concrete prerequisites must all hold: (1) the attacker has push access to the shared checkpoints repository and can write to the remote entire/checkpoints/v1 branch from which checkpoint metadata is fetched; (2) the crafted checkpoint metadata carries a SessionID field containing an absolute path or path traversal sequences, since SessionID was used to construct filesystem paths without validation in the restore path; and (3) the victim subsequently runs entire session resume or entire checkpoint rewind on that repository (UI:A - victim action is required to trigger the write). Limiting factors: exploitation is impossible without push rights to the shared branch, so single-user repositories or repositories where untrusted users cannot push are not exposed; the victim must actively invoke a resume/rewind command; and only versions <= 0.7.6 are affected (0.7.7 enforces traversal-resistant validation). Per the vendor, the workarounds (avoiding resume/rewind on untrusted repos, restricting push access, inspecting the branch, protecting shell init files) reduce exposure but do not fully address the issue - upgrading is the complete fix.

This is a moderate-severity, precondition-heavy supply-chain-style flaw rather than a drive-by remote exploit. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:H, 6.2) shows that while the metadata is fetched over the network (AV:N, AC:L), exploitation requires attacker privileges (PR:L - push access to the shared checkpoints repository) and active victim interaction (UI:A - the victim must run resume or rewind). Impact is concentrated on the subsequent system: integrity and availability high (SI:H/SA:H) because arbitrary host files can be overwritten, with no confidentiality loss (VC:N/SC:N). Exploitation status: no public exploit identified at time of analysis - the three references are the GHSA advisory and two patch pull requests (code fixes, not exploit code), and the input provides no KEV listing and no EPSS score. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-not-urgent issue gated behind push access and a user action. There is no signal conflict here: every source points to a serious-if-triggered arbitrary file write whose real-world exposure is sharply limited by the need for both repository push rights and a victim-initiated resume/rewind. EPSS is absent, so probabilistic exploitation likelihood cannot be quantified from the provided data.

An attacker with push access to a team's shared Entire checkpoints repository pushes a malicious checkpoint whose SessionID field contains path traversal sequences or an absolute path. When a collaborator later runs entire session resume or entire checkpoint rewind, the CLI uses the unvalidated SessionID to build a filesystem path and writes attacker-controlled transcript data outside the session directory - for example overwriting the victim's shell initialization file to achieve code execution. No public exploit code was identified in the provided sources.