mini-swe-agent environment variable exposure via prompt injection

mini-swe-agent versions 1.10.0 through 2.4.6 expose host environment variables including API keys to sandboxed commands due to missing --clearenv flag in Bubblewrap, allowing attackers to exfiltrate credentials via prompt injection.

Disclosed 10 October 2026 · Record updated 10 October 2026

Impact

API keys and sensitive environment variables can be exfiltrated from the host environment by attackers using prompt injection in task content.

Our coverage

A locked glass box sits open, revealing internal machinery while invisible hands reach through transparent walls to pluck glowing keys from the shadows within.

Vulnerabilities

Sandbox flaw in mini-swe-agent can leak API keys to injected tasks

A missing Bubblewrap flag means sandboxed commands inherit the host environment, according to an advisory published on 10 October 2026.

10 Oct 2026

Sources

nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-108592