Mini Swe Agent
Monthly
Information exposure in mini-swe-agent versions 1.10.0 through 2.4.6 allows remote attackers to read sensitive environment variables, such as API keys, from the host system when the BubblewrapEnvironment sandbox is used. The sandbox fails to clear the environment (missing --clearenv), so sandboxed commands inherit the host environment. An attacker can leverage prompt injection in processed task content to direct the agent to exfiltrate these secrets over the network. Exploitation requires the use of BubblewrapEnvironment, presence of sensitive variables in the environment, and attacker-controlled task content; it is a moderate, context-dependent risk, and no public exploit has been identified at the time of analysis.
Information exposure in mini-swe-agent versions 1.10.0 through 2.4.6 allows remote attackers to read sensitive environment variables, such as API keys, from the host system when the BubblewrapEnvironment sandbox is used. The sandbox fails to clear the environment (missing --clearenv), so sandboxed commands inherit the host environment. An attacker can leverage prompt injection in processed task content to direct the agent to exfiltrate these secrets over the network. Exploitation requires the use of BubblewrapEnvironment, presence of sensitive variables in the environment, and attacker-controlled task content; it is a moderate, context-dependent risk, and no public exploit has been identified at the time of analysis.