CVE-2026-122235 in Jan
Summary
by MITRE • 11/04/2026
Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to make the write or edit tools follow symlinks, creating files like ~/.ssh/authorized_keys on the host.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in Jan versions prior to 0.8.8 represents a critical security flaw within the agent-tools component, specifically located in the gate.rs module responsible for managing workspace boundaries and file system operations. This issue is classified as a Workspace Guard Bypass, which fundamentally undermines the isolation mechanisms designed to restrict an AI agent's interactions to a designated project directory or sandboxed environment. The core technical failure lies in how the application resolves file paths when executing write or edit commands through its tooling interface. Instead of strictly validating that the target path resides within the allowed workspace root after symbolic link resolution, the system fails to account for dangling symlinks or improperly configured links that point outside the permitted boundary. This oversight allows an attacker who has control over a repository accessed by the agent to manipulate file paths in a way that exploits this lack of validation.
The operational impact of this vulnerability is severe, as it enables arbitrary remote code execution potential through social engineering and prompt injection techniques. An adversary can supply a malicious repository containing specially crafted symlinks or instruct the AI via prompt injection to write content to specific system locations by referencing these links. For instance, an attacker could direct the agent to create or modify files in sensitive directories such as ~/.ssh/authorized_keys on the host machine. By injecting commands that appear legitimate within the context of a coding task but actually target system configuration files, the attacker can establish persistent access mechanisms without needing traditional authentication credentials. This effectively breaks out of the sandboxed environment and grants the agent privileges to interact with the underlying operating system in ways intended to be prohibited by the workspace guard.
From an industry standards perspective, this vulnerability aligns closely with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, as it involves traversing outside restricted directories via symbolic link manipulation. It also relates to CWE-78 OS Command Injection if the write operations are leveraged to execute further commands through system-level configurations. In terms of attack vectors and tactics, this scenario maps directly to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter for executing instructions via prompt injection and T1496 Resource Hijacking or Persistence mechanisms like T1098 Account Manipulation when modifying SSH keys. The exploitation relies heavily on the trust placed in user-supplied repositories, highlighting a risk associated with integrating external code sources into automated development workflows without rigorous path validation.
Mitigation strategies must focus on strengthening input validation and enforcing strict sandboxing protocols within the agent-tools architecture. Developers should implement canonicalization of file paths before any write or edit operation occurs, ensuring that the resolved absolute path remains strictly within the designated workspace root directory regardless of symlink targets. Additionally, employing operating system-level restrictions such as chroot jails or containerized environments can provide an additional layer of defense by limiting the agent's visibility and access to host-specific directories like .ssh. Regular security audits of code handling file I/O operations are essential to identify similar path traversal weaknesses. Users should also be advised to exercise caution when allowing AI agents to interact with repositories from untrusted sources, as prompt injection remains a significant vector for bypassing application-level controls in generative AI systems.