CVE-2026-122235 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Jan, an AI app, has a flaw in its agent tools where the write and edit tools follow dangling symlinks and write files outside the project workspace. A malicious repository plus prompt injection can make the agent create files such as ~/.ssh/authorized_keys on the host.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Users running Jan from 0.8.5 before 0.8.8 who let its agent write or edit files in a repository they did not fully trust. Exposure depends on the agent tools being used with untrusted content; people who only use Jan for chat without agent file tools are less exposed.
Not affected if no-agent-file-tools, trusted-repos-only, version-0.8.8-or-later
Who cares ai-agents, desktop, jan, local-llm
0.8.8 or laterJan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to make the write or edit tools follow symlinks, creating files like ~/.ssh/authorized_keys on the host.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.