open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Open-multi-agent
  • Open-multi-agent

No data.

No data.

References
Link Providers
https://github.com/open-multi-agent/open-multi-agent cve-icon cve-icon
https://github.com/open-multi-agent/open-multi-agent/blob/6ec5498643c7e431aa66751f17f47a529e7f927c/packages/core/src/tool/built-in/file-write.ts#L67 cve-icon cve-icon
https://github.com/open-multi-agent/open-multi-agent/blob/6ec5498643c7e431aa66751f17f47a529e7f927c/packages/core/src/tool/built-in/path-safety.ts#L104-L113 cve-icon cve-icon
https://hackmd.io/@haind/open-multi-agent-file-write-dangling-symlink-escape cve-icon cve-icon cve-icon
https://www.vulncheck.com/advisories/open-multi-agent-1.5.0-through-1.21.2-sandbox-escape-via-file-write-dangling-symlink cve-icon cve-icon
History

Tue, 13 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 11 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Open-multi-agent
Open-multi-agent open-multi-agent
Vendors & Products Open-multi-agent
Open-multi-agent open-multi-agent

Sat, 10 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write.
Title open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink
Weaknesses CWE-59
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'}

cvssV4_0

{'score': 5.7, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-10T18:58:16.432Z

Updated: 2026-10-13T18:54:52.634Z

Reserved: 2026-10-10T18:25:15.230Z

Link: CVE-2026-108600

cve-icon Vulnrichment

Updated: 2026-10-13T18:54:47.398Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T19:16:58.640

Modified: 2026-10-16T19:21:14.417

Link: CVE-2026-108600

cve-icon Redhat

No data.