CVE-2026-108751: MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer
MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so atomicWriteFile truncates and overwrites victim-writable files with MoAI template content.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of MoAI-ADK through 3.1.2 are exposed when they run moai init against a malicious repository containing a crafted symlinked .moai-tmp staging path. The impact is limited to files the user running the command can write.
What must an attacker do to exploit it?
An attacker must prepare a repository with a symlink such as .claude/settings.json.moai-tmp that resolves outside the project. They also need a victim to run moai init on that repository, which causes the template deployer to follow the link and overwrite the target with MoAI template content.
How can I check whether a repository is suspicious before running initialization?
Inspect the repository for symlinks using .moai-tmp staging paths, including files named like .claude/settings.json.moai-tmp. Such links can point outside the project directory and should not be trusted when running moai init.