Jan workspace guard bypass via dangling symlinks

Jan versions 0.8.5 before 0.8.8 contain a vulnerability in agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers can use prompt injection with malicious repositories to create files like ~/.ssh/authorized_keys on the host.

Disclosed 4 November 2026 · Record updated 4 November 2026

Impact

Attackers can write arbitrary files outside the workspace, potentially creating SSH keys or other sensitive files on the host system via prompt injection and symlink exploitation.

Our coverage

A robot's arm reaches through a symbolic link chain, placing files into forbidden directories beyond its designated workbench's protective boundary.

Vulnerabilities

Symlink flaw let Jan's coding agent write files outside workspace

CVE-2026-122235 affects Jan 0.8.5 up to 0.8.8 and could be triggered by prompt injection hidden in a malicious repository, according to the NVD entry.

4 Nov 2026

Sources

nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-122235