CVE-2026-122235

MEDIUM 4.7

Jan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink

CVSS Score

4.7

EPSS Score

0.0%

EPSS Percentile

0th

Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to make the write or edit tools follow symlinks, creating files like ~/.ssh/authorized_keys on the host.

CWE	CWE-59
Vendor	janhq
Product	jan
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for janhq jan

Be the first to know when new medium vulnerabilities affecting janhq jan are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

janhq / jan

0.8.5 < 0.8.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/janhq/jan/security/advisories/GHSA-7j4g-mj5j-p842 github.com: https://github.com/janhq/jan/pull/9424 github.com: https://github.com/janhq/jan/commit/840c33e65182ba9975d32f710c5d111e25444b65 github.com: https://github.com/janhq/jan/releases/tag/v0.8.8 vulncheck.com: https://www.vulncheck.com/advisories/jan-0.8.5-before-0.8.8-workspace-guard-bypass-via-dangling-symlink

Credits

Zachariah Mithani (AploSec)