CVE-2026-57208 in cli
Summary
by MITRE • 10/23/2026
Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata that causes entire session resume or entire checkpoint rewind to write attacker-controlled transcript data outside of the expected session directory. The issue occurs because checkpoint metadata is fetched from the remote entire/checkpoints/v1 branch and the SessionID field was used to construct filesystem paths without validation in the restore path. A malicious SessionID containing absolute paths or path traversal sequences could cause arbitrary files on the victim’s machine to be overwritten. This issue has been patched in version 0.7.7.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified as a path traversal flaw within the Entire CLI tool prior to version 0.7.7 represents a critical security risk for organizations utilizing AI agent workflows that rely on Git-based checkpointing mechanisms. The core of this issue lies in how the application handles metadata fetched from remote repositories, specifically the entire/checkpoints/v1 branch. When an attacker possesses push access to the checkpoints repository, they can manipulate the checkpoint metadata by injecting malicious SessionID values. These identifiers are not merely used for logging or identification purposes but are directly incorporated into filesystem path construction logic during session resume and checkpoint rewind operations. Because the application fails to validate these inputs against a whitelist of allowed characters or paths, it allows absolute paths and directory traversal sequences such as dot-dot-slash to be processed without restriction.
From a technical perspective, this flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The vulnerability exploits the lack of sanitization in the restore path logic. When the CLI attempts to resume a session or rewind a checkpoint, it constructs file paths based on the SessionID field found in the remote metadata. If this identifier contains sequences designed to escape the intended directory structure, the underlying filesystem operations will write data to arbitrary locations on the victim’s machine rather than within the expected session directory. This behavior effectively bypasses standard sandboxing or isolation boundaries that might otherwise protect sensitive system files from being overwritten by application-specific processes.
The operational impact of this vulnerability is severe, as it enables an attacker with push access to the checkpoints repository to achieve arbitrary file write capabilities on the target host. By overwriting critical configuration files, scripts, or binaries, an attacker could potentially escalate privileges, install persistent backdoors, or disrupt system integrity. This scenario aligns with ATT&CK technique T1074: Data Staged, where attackers stage data in a local location before moving it to its final destination, although in this case, the staging and execution implications are tied directly to file overwrites that can facilitate further exploitation vectors such as command injection or configuration tampering. The risk is particularly acute in collaborative environments where multiple users have write access to shared checkpoint repositories, making trust assumptions about metadata integrity dangerous without proper validation.
Mitigation strategies must prioritize immediate patching of the Entire CLI to version 0.7.7 or later, which addresses this path traversal issue by implementing strict input validation for SessionID fields and ensuring that all filesystem operations are confined within designated safe directories. In addition to upgrading software, organizations should enforce least-privilege access controls on Git repositories containing checkpoint metadata to prevent unauthorized users from pushing maliciously crafted checkpoints. Implementing code signing or integrity checks for repository contents can also help detect tampered metadata before it is processed by the CLI. Security teams should monitor for unusual file system changes in directories where AI agent sessions are stored, as these may indicate exploitation attempts targeting this specific vulnerability vector.