MoAI-ADK EUVD-2026-96916

Exploitation requires the victim to run the MoAI-ADK init template deployer (moai init) inside or against a repository the attacker controls, where the attacker has committed a symlink whose name matches the deployer's staging suffix (e.g., .claude/settings.json.moai-tmp) and which points to a file outside the project. Limiting factors: the attack is local (AV:L) and needs user interaction (UI:P) - the victim must clone/trust and execute the tool on the malicious repository; impact is bounded to files the victim user can already write (victim-writable targets, VI:L/VA:L); and it is confined to MoAI-ADK versions through 3.1.2. No authentication to the tool is required, but no remote or default-configuration network exploitation is possible.

This is a medium-severity, low-urgency issue rather than a top priority. The CVSS 4.0 base score of 4.8 is consistent with the vector: AV:L plus UI:P means exploitation is not remote or automatic - a victim must obtain an attacker-controlled repository and actively run the MoAI-ADK template deployer (moai init) against it, which sharply limits mass or opportunistic exploitation and pushes this toward a targeted, supply-chain / social-engineering style attack. Impact is partial (VI:L/VA:L) and limited to files the victim can already write; VC:N confirms no confidentiality loss. No EPSS score is provided, the CVE is NOT in CISA KEV, and no public exploit code was identified - only a technical write-up (hackmd) and vendor source-code references exist, so this reflects disclosure/analysis maturity, not demonstrated in-the-wild use. SIGNAL CONFLICT: the input tag 'Information Disclosure' contradicts the CVSS vector, which shows VC:N (no confidentiality impact) and only integrity/availability impact - this is a file-overwrite/integrity flaw, not disclosure; treat the tag as mislabeled. Overall, a real but niche risk requiring attacker-controlled input plus victim action.

An attacker publishes a malicious Git repository containing a crafted symlink (e.g., .claude/settings.json.moai-tmp) that points to a sensitive file outside the project tree. A developer clones the repository and runs the MoAI-ADK init template deployer, whose atomicWriteFile follows the symlinked staging path and truncates/overwrites the victim-writable target file with MoAI template content. No public exploit code was identified; the mechanism is documented in a hackmd technical write-up and the vendor's deployer.go source.