CVE-2026-108592: Cleartext Storage of Sensitive Information in an Environment Variable in SWE-agent mini-swe-agent

The vulnerability in mini-swe-agent (versions 1.10.0 through 2.4.6) arises because the BubblewrapEnvironment component uses bwrap without the --clearenv option. This omission causes sandboxed commands to inherit environment variables from the host system. An attacker who can perform prompt injection in processed task content can exploit this to read sensitive environment variables, including API keys, and exfiltrate them over the network. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial attack type privileges, user interaction required, and high impact on confidentiality.

Attackers can gain unauthorized access to sensitive information stored in environment variables, such as API keys, by exploiting prompt injection vulnerabilities. This exposure can lead to credential theft and unauthorized access to services relying on those keys. The vulnerability does not indicate privilege escalation or integrity/availability impacts but poses a confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted input that could lead to prompt injection, and consider restricting environment variable exposure in sandboxed commands if possible.