Description

open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-10-10T19:16:58.640Z",
  "pubdate": "2026-10-10T19:16:58.640Z",
  "executiveSummary": "The @open-multi-agent/core package, spanning versions 1.5.0 through 1.21.2, is susceptible to a critical path traversal vulnerability within its file_write tool sandbox.\nThis vulnerability stems from the agent's failure to adequately validate file system operations when encountering symbolic links.\nBy planting a dangling symlink within the designated workspace, an attacker can coerce the agent into performing write operations outside the intended root directory.\nThrough prompt injection, an attacker can manipulate the agent's logic to write arbitrary content to sensitive locations accessible by the agent process, potentially leading to unauthorized data modification, configuration tampering, or system compromise.\nThe vulnerability effectively bypasses intended sandbox protections, granting attackers control over file system interactions that should be constrained by the application's workspace boundaries.\nSuccessful exploitation requires the ability to place content in the workspace and subsequently influence the agent's execution via prompt injection, highlighting significant risks in environments where untrusted user input is processed by AI agents.",
  "technicalDetails": "The vulnerability resides within the file_write tool of the @open-multi-agent/core package. The root cause is the improper handling of symbolic links when performing file system writes. Specifically, the agent does not canonicalize the destination path or detect if a write operation resolves to a location outside the defined workspace root directory.\nThe exploitation flow begins with the attacker creating a 'dangling symlink'—a symbolic link that points to a target path outside the workspace—within the agent's accessible environment. Because the symlink is 'dangling' (the target does not yet exist), it may not be immediately detected or blocked by simplistic file validation mechanisms.\nOnce the symlink is established, the attacker utilizes prompt injection techniques to influence the agent's instructions. By inducing the agent to execute a write operation targeting the file path of the dangling symlink, the underlying operating system resolves the symlink and proceeds to write the provided content to the actual target location, which resides outside the intended sandbox.\nThis behavior leverages the agent process's inherent file system permissions. If the agent process runs with elevated privileges or has write access to critical configuration files, libraries, or system binaries, the attacker can leverage this primitive to achieve arbitrary file modification. This could lead to remote code execution (RCE) if the attacker can overwrite executable files or configuration files that control process behavior.\nAffected versions include 1.5.0 through 1.21.2. The vulnerability does not necessarily require direct authentication, but rather relies on the agent's ingestion of attacker-controlled input, either via prompt injection or the ability to populate the agent's workspace with malicious files prior to execution.\nBecause the sandbox mechanism fails to enforce strict containment via path canonicalization (e.g., ensuring the resolved path starts with the designated workspace root prefix), the agent essentially ignores the boundaries of its expected execution environment, allowing for predictable path traversal and unauthorized file system writes."
}