Open Multi Agent
Monthly
Sandbox escape in open-multi-agent's @open-multi-agent/core 1.5.0 through 1.21.2 lets an attacker write attacker-influenced files anywhere the agent process has write permission by planting a dangling symlink inside the agent workspace and using prompt injection to steer the file_write built-in tool toward that symlink path. Impact is integrity-only in the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), and exploitation is gated on two preconditions combining: attacker-controlled symlink placement in the workspace plus prompt-injection influence over the agent, so this is a genuine but moderate-priority issue rather than a remote, default-configuration exploit. No public exploit code or active exploitation was identified at time of analysis, and the flaw requires local reachability with no privileges required per the assessed vector.
Sandbox escape in open-multi-agent's @open-multi-agent/core 1.5.0 through 1.21.2 lets an attacker write attacker-influenced files anywhere the agent process has write permission by planting a dangling symlink inside the agent workspace and using prompt injection to steer the file_write built-in tool toward that symlink path. Impact is integrity-only in the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), and exploitation is gated on two preconditions combining: attacker-controlled symlink placement in the workspace plus prompt-injection influence over the agent, so this is a genuine but moderate-priority issue rather than a remote, default-configuration exploit. No public exploit code or active exploitation was identified at time of analysis, and the flaw requires local reachability with no privileges required per the assessed vector.