CVE-2026-122235
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to make the write or edit tools follow symlinks, creating files like ~/.ssh/authorized_keys on the host.
Risk Assessment
An attacker could achieve remote code execution or persistent host access by overwriting SSH keys, leading to full system compromise. The risk affects environments where Jan processes untrusted repositories.
Recommendation
Update Jan to version 0.8.8 or later. Restrict processing of untrusted repositories and consider running the tool in an isolated environment.
Other vulnerabilities in Jan
Original NVD description (English source)
Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to make the write or edit tools follow symlinks, creating files like ~/.ssh/authorized_keys on the host.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS