{"id":"CVE-2026-111045","kind":"vulnerability","aliases":["CVE-2026-111045"],"related":[],"title":"CLI Bridge: dangling symlink lets file writes escape the workspace root","description":"CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path as safe, so write_file follows the link and can write arbitrary files outside the workspace root. This issue is fixed in version 0.0.2.","summary":"CLI Bridge checks file paths against the workspace root, but a dangling symlink pointing outside the workspace passes that check when its target does not exist. A write_file call then follows the link and can create or overwrite arbitrary files outside the workspace.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cli-bridge","filesystem","node","package"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed CLI Bridge version with `npm ls cli-bridge` (package name unknown; confirm in the project's lockfile)\n- Look for symlinks inside the workspace root that point outside it, for example `find <workspace> -type l -exec ls -l {} +`","fix":"- Upgrade CLI Bridge to `0.0.2` or later","status":"open","published_at":"2026-10-19T16:17:03+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:22:58+00:00","updated_at":"2026-10-25T03:22:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:22:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade CLI Bridge to `0.0.2` or later","reach":"unknown","title":"CLI Bridge: dangling symlink lets file writes escape the workspace root","impact":"high","summary":"CLI Bridge checks file paths against the workspace root, but a dangling symlink pointing outside the workspace passes that check when its target does not exist. A write_file call then follows the link and can create or overwrite arbitrary files outside the workspace.","category":"package","nicknames":[],"who_cares":["cli-bridge","filesystem","node"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Arbitrary files outside the workspace can be written by the server","analyst_note":"Confirm the affected package name and exposure path (who can call write_file and create symlinks) via the NVD entry and the project's advisory.","how_to_check":"- Check the installed CLI Bridge version with `npm ls cli-bridge` (package name unknown; confirm in the project's lockfile)\n- Look for symlinks inside the workspace root that point outside it, for example `find <workspace> -type l -exec ls -l {} +`","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Teams running CLI Bridge versions before 0.0.2 where an agent or user can make write_file calls inside a workspace root and can create symlinks there. Exposure depends on the write path being reachable; the sources do not say how the bridge is exposed to callers.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000608,"input_tokens":3350,"output_tokens":547,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111045':14A,17A '-2026':13A,16A '0.0.2':79C,133C 'access':72C 'arbitrari':63B,121C 'bridg':2A,20B,25B,69C 'bypass':88C 'call':53B 'check':26B,43B 'cli':1A,19B,24B,68C 'cli-bridg':18B 'creat':60B 'cve':12A,15A 'dangl':3A,35B,81C 'directori':104C 'enoent':93C 'escap':8A 'exist':49B 'fallback':99C 'file':6A,27B,52B,64B,114C,122C 'filesystem':21B,71C 'fix':130C 'follow':55B,115C 'fs.realpathsync':91C 'issu':128C 'let':5A 'link':57B,117C 'node':22B 'nonexist':96C 'outsid':38B,65B,84C,123C 'overwrit':62B 'packag':23B 'parent':103C 'pass':41B 'path':28B,109C 'point':37B,83C 'prior':77C 'provid':70C 'resolv':100C 'resolvesafepath':89C 'return':106C 'root':11A,32B,76C,87C,126C 'safe':111C 'symlink':4A,36B,82C,108C 'target':46B,97C 'throw':92C 'version':132C 'within':73C 'workspac':10A,31B,40B,67B,75C,86C,125C 'write':7A,51B,113C,120C","nicknames":[],"mitigations":[],"who_affected":"Teams running CLI Bridge versions before 0.0.2 where an agent or user can make write_file calls inside a workspace root and can create symlinks there. Exposure depends on the write path being reachable; the sources do not say how the bridge is exposed to callers.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111045","severity":null,"published_at":"2026-10-19T16:17:03+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}