CVE-2026-111045
7.5HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-59
Impact
Attackers can write arbitrary files outside the workspace root, potentially overwriting critical system files. They need network access to send file-write requests to the CLI Bridge service.
Root cause
When resolveSafePath encounters a dangling symlink, fs.realpathSync throws ENOENT and the fallback logic only validates the parent directory, erroneously marking the symlink path safe for file writing.
Affected systems
CLI Bridge prior to 0.0.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Fix & remediation
Upgrade CLI Bridge to version 0.0.2 or later. If upgrading immediately is not possible, restrict access to the service or stop the CLI Bridge process until patched.
$ npm install cli-bridge@0.0.2AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path as safe, so write_file follows the link and can write arbitrary files outside the workspace root. This issue is fixed in version 0.0.2.