Workspace guard bypass in Jan lets attackers write files outside workspace
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass in the agent-tools gate.rs that lets attackers write files outside the workspace through dangling symlinks. An attacker who supplies a malicious repository can use prompt injection to make the write or edit tools follow symlinks and create files such as ~/.ssh/authorized_keys on the host. The flaw is classified as CWE-59, improper link resolution before file access.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to make the write or edit tools follow symlinks, creating files like ~/.ssh/authorized_keys on the host.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Jan users should update to version 0.8.8, which fixes the flaw in janhq jan.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA jan (janhq) Fixed in 0.8.8
Timeline
- 2026-11-04 Threatist record created from CVE-2026-122235
- 2026-11-04 Alias added: GHSA-pjpc-p955-xv4f
- 2026-11-06 Priority changed: MEDIUM → LOW
References
More janhq vulnerabilities
- TI-2026-47003 Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-122235 · CVE Program
- CVE-2026-122235 · NVD
- FIRST EPSS
- GHSA-pjpc-p955-xv4f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences