Is there a public PoC exploit available for CVE-2026-65698?

Yes, a public proof-of-concept exploit is available for CVE-2026-65698. Prioritise patching immediately. EPSS: 0.3%.

Void Editor CVE-2026-65698

Q: What is the CVSS score of CVE-2026-65698?

CVE-2026-65698 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-48312 MEDIUM

Path Traversal (CWE-22)

2026-07-23 VulnCheck

GHSA-739h-jx7m-fc7g

Path Traversal Red Hat Void

6.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

AV:N for network-delivered prompt injection content; AC:H for required injection success; PR:N as no auth needed; UI:R since user must trigger agent on malicious content; C:H for credential exposure; no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:19 vuln.today

CVE Published

Jul 23, 2026 - 16:37 cve.org

MEDIUM 6.0

DescriptionCVE.org

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file:// URIs through the read_file, ls_dir, get_dir_tree, and search_* tools, which lack workspace confinement and bypass the approval gate, enabling silent exfiltration of sensitive files such as SSH private keys or cloud credentials via subsequent tool calls.

AnalysisAI

Path traversal via prompt injection in Void editor through 1.3.4 allows network attackers who can deliver malicious content into the AI agent's processing context to silently read arbitrary host files outside the open workspace, including SSH private keys and cloud credentials. The AI agent's file-reading tools (read_file, ls_dir, get_dir_tree, search_*) accept absolute filesystem paths and file:// URIs without workspace confinement and bypass the built-in approval gate, enabling silent exfiltration. No CISA KEV listing exists, but a publicly available proof-of-concept exploit has been published, confirming exploitability; the AC:H rating reflects the prompt injection prerequisite rather than any technical barrier once malicious content is ingested.

Technical ContextAI

Void is an AI-powered code editor (CPE: cpe:2.3:a:voideditor:void) that exposes a set of AI agent file-reading tools integrated into its agentic workflow. The root cause is CWE-22 (Path Traversal): the tools read_file, ls_dir, get_dir_tree, and the search_* family accept user-supplied or agent-resolved file paths without validating that those paths remain within the configured workspace directory. Critically, the tools also bypass the editor's approval gate-a safety mechanism intended to require explicit user confirmation before sensitive operations-allowing file reads to complete silently. The attack vector is indirect prompt injection: an attacker embeds malicious instructions into any content the AI agent processes (e.g., a crafted README, a document in a cloned repository, or a webpage loaded into agent context). These instructions redirect the agent to invoke the vulnerable file-reading tools against attacker-specified absolute paths or file:// URIs, exfiltrating the results through subsequent tool calls. The vulnerability exists at the intersection of insufficient path sanitization and an insecure agent tool design that places excessive trust in agent-generated inputs.

RemediationAI

No vendor-released patch has been identified at time of analysis; neither the VulnCheck advisory nor the PoC reference cites a fixed version, and no version beyond 1.3.4 is confirmed to address this issue. As an immediate compensating control, avoid opening or processing untrusted external content (cloned repositories from unknown sources, external documents, web pages) with the Void AI agent enabled, as the attack depends on prompt injection through agent-processed content. If the AI agent's file-reading tools (read_file, ls_dir, get_dir_tree, search_*) can be individually disabled or restricted in Void's configuration, doing so eliminates the attack surface directly at the cost of reduced AI-assisted file navigation functionality. Running Void inside a sandboxed or containerized environment with a restricted filesystem mount (e.g., bind-mounting only the project directory) would limit the blast radius of any successful exploitation, preventing the agent from reaching credential files at ~/ or system paths-this is the strongest compensating control and does not impair editor functionality. Monitor the voideditor project and https://www.vulncheck.com/advisories/void-path-traversal-via-ai-agent-file-reading-tools for a patched release.