Threats tagged 'ghsa-8g37-89wr-9v3c'

CVE-2026-89229 is a path traversal vulnerability in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot). A malicious app on the same device can exploit this flaw by sending a crafted ACTION_SEND intent with a specially crafted file name containing '..' sequences, allowing arbitrary file writes. This vulnerability has a medium severity rating and does not currently have known exploits in the wild or an available patch.