CVE-2026-65698: voideditor void, обхождане на път

Описание

Оригинално описание

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file:// URIs through the read_file, ls_dir, get_dir_tree, and search_* tools, which lack workspace confinement and bypass the approval gate, enabling silent exfiltration of sensitive files such as SSH private keys or cloud credentials via subsequent tool calls.

Засегнати продукти

• voideditor void: до 1.3.4

Вид слабост

• CWE-22 Неправилно ограничаване на път до позволена директория

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-65698
• https://nvd.nist.gov/vuln/detail/CVE-2026-65698
• https://github.com/geo-chen/oss/blob/main/void.md
• https://www.vulncheck.com/advisories/void-path-traversal-via-ai-agent-file-reading-tools