Vulnerabilities

TI-2026-60301 CVE-2026-88940 · GHSA-hm5p-8v8f-2vgm

knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint

HIGH 70

knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00559 Published 2026-09-10 No fix listed CWE-22

TI-2026-60300 CVE-2026-88939 · GHSA-qwj4-f78f-jj3j

knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption

HIGH 73

knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00478 Published 2026-09-10 No fix listed CWE-863

Vulnerabilities

Filters

knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint

knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption