Threats tagged 'ghsa-pjpc-p955-xv4f'

Jan versions from 0.8.5 up to but not including 0.8.8 contain a vulnerability in the agent-tools gate.rs component that allows attackers to bypass workspace guards. This flaw enables writing files outside the intended workspace via dangling symlinks, potentially allowing attackers to create or modify sensitive files such as ~/.ssh/authorized_keys on the host system by supplying a malicious repository and using prompt injection.