Add CVE-2026-108592

2026/CVE-2026-108592/README.md

@@ -0,0 +1,93 @@
+# CVE-2026-108592 — mini-swe-agent Expousure of Sensitive Information & Cleartext Storage of Sensitive Information in an Environment Variable PoC & Exploit Analysis
+
+| Field | Value |
+|---|---|
+| **CVE ID** | CVE-2026-108592 |
+| **CVSS Score** | 4.2 (e.g. 9.8 CRITICAL) |
+| **Vendor / Product** | mini-swe-agent |
+| **Affected Versions** | 1.10.0 - 2.4.6 |
+| **Vulnerability Class** | Expousure of Sensitive Information |
+| **CWE ID** | CWE-526/CWE-200 |
+| **Disclosure Date** | 2026-10-10 |
+| **Public Advisory** | [Vendor advisory](https://www.cve.org/CVERecord?id=CVE-2026-108592) |
+| **Original Researcher** | HaiND (Nguyen Dinh Hai), Post and Telecommunication Institute of Technology, github.com/Haind03 |
+| **PoC Added By** | [asvorg](https://github.com/asvorg/) |
+| **Status** | Verified |
+
+## 📝 Vulnerability Summary & Root Cause
+
+CVE-2026-108592 describes a potential security issue in which commands running inside a Bubblewrap sandbox may inherit environment variables from the host environment (CWE-526).
+Environment variables sometimes contain sensitive information, such as API keys, access tokens, and service credentials. If a sandbox exposes these values to commands that should not have access to them, sensitive information could be at risk.
+he root cause is that the sandbox is inheriting environment variables from the host process instead of starting with a sanitized environment. In the PoC, the host sets CVE_TEST_MARKER via os.environ, then creates BubblewrapEnvironment with env={}; however, the sandbox still exposes that variable to commands executed inside it. As a result, a command such as printf "%s\n" "$CVE_TEST_MARKER" can read the host variable from inside the sandbox, which is the vulnerability. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network.
+
+## 🔗 Verified Upstream Researcher Proof-of-Concepts
+
+| Researcher / Organization | Repository / Analysis Link | Type | Verification Status |
+|---|---|---|:---:|
+| @asvorg | https://github.com/asvorg/CVE-2026-108592-poc | Exploit Script (Python/Go) | ✅ Verified |
+
+## 🧪 Affected Environment & Lab Setup
+
+- mini-swe-agent version 1.10.0-2.4.6
+- Verify brwap is installed with `bwrap --version`, if not, install it with `pip install brawp`
+
+### Setup
+
+Follow the official installation instructions for the version of [mini-swe-agent](https://github.com/swe-agent/mini-swe-agent) you intend to test.
+
+Run the test from the Python environment where `mini-swe-agent` is installed:
+
+```bash
+python3 poc.py
+```
+
+Create a dummy marker:
+
+```
+export CVE_TEST_MARKER="dummy-value-12345"
+```
+The test marker is:
+
+```text
+CVE_TEST_MARKER=dummy-test-value-108592
+```
+
+## 🛡️ Proof of Concept (Non-Destructive Verification)
+
+> ⚠️ For authorized testing and lab environments only. See repo-wide [disclaimer](../../README.md#disclaimer).
+
+### Expected Results
+
+#### Marker is visible
+
+Run `poc.py`
+
+Example output:
+
+```text
+Sandbox exit code: 0
+Marker output: 'dummy-test-value-108592\n'
+CONFIRMED: dummy marker inherited by sandbox.
+```
+
+This indicates that the tested sandbox configuration allowed the command to observe the dummy host environment variable.
+
+See [`poc.py`](./poc.py) for the safe verification skeleton.
+
+## 💥 Impact
+
+- Exposure of environment variables
+- Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network.
+
+## 🔧 Remediation & Mitigation
+
+- Upgrade to mini-swe-agent version >2.4.6
+
+## 📚 References & Advisory Links
+
+- Vendor advisory: 
+- NVD entry: https://nvd.nist.gov/vuln/detail/cve-2026-108592
+- CVE entry: https://www.cve.org/CVERecord?id=CVE-2026-108592
+
+---
+[← Back to CVE-2026-PoCs Index](../../README.md)

2026/CVE-2026-108592/poc.py

@@ -0,0 +1,45 @@
+import os
+import tempfile
+from pathlib import Path
+
+from minisweagent.environments.extra.bubblewrap import (
+    BubblewrapEnvironment,
+)
+
+MARKER_NAME = "CVE_TEST_MARKER"
+MARKER_VALUE = "dummy-test-value-108592"
+
+def main():
+    # Use only a harmless dummy variable.
+    os.environ[MARKER_NAME] = MARKER_VALUE
+
+    with tempfile.TemporaryDirectory(
+        prefix="cve_108592_"
+    ) as tmp:
+        env = BubblewrapEnvironment(
+            cwd=str(Path(tmp).resolve()),
+            env={},
+            timeout=10,
+        )
+
+        try:
+            result = env.execute({
+            "command": 'printf "%s\\n" "$CVE_TEST_MARKER"'
+        })
+
+            output = result.get("output", "")
+            code = result.get("returncode")
+
+            print("Sandbox exit code:", code)
+            print("Marker output:", repr(output))
+
+            if code == 0 and MARKER_VALUE in output:
+                print("CONFIRMED: dummy marker inherited by sandbox.")
+            else:
+                print("Marker not confirmed; inspect the output and setup.")
+        finally:
+            env.cleanup()
+            os.environ.pop(MARKER_NAME, None)
+
+if __name__ == "__main__":
+    main()