GHSA-7j4g-mj5j-p842: Jan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink

Published Nov 4, 2026

Updated

Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to make the write or edit tools follow symlinks, creating files like ~/.ssh/authorizedkeys on the host.

Event History

Nov 4, 2026

CVE Published

via OSV·09:06 PM

Data Sourced

via OSV·09:06 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users running Jan versions from 0.8.5 up to, but not including, 0.8.8 are exposed when they allow the agent to work with a malicious repository. The impact occurs on the host running Jan, outside the intended workspace.

What does exploitation require?

An attacker needs to supply a repository containing dangling symlinks and use prompt injection to cause Jan's write or edit tools to operate on them. No attacker privileges are listed, but user interaction is required.

What can an attacker do if exploitation succeeds?

The write or edit tools can follow a dangling symlink and create files outside the workspace. The advisory gives ~/.ssh/authorized_keys as an example target, which could allow modification of SSH authorization on the host.

GHSA-7j4g-mj5j-p842: Jan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does exploitation require?

What can an attacker do if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does exploitation require?

What can an attacker do if exploitation succeeds?