CVE-2026-65698

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file:// URIs through the read_file, ls_dir, get_dir_tree, and search_* tools, which lack workspace confinement and bypass the approval gate, enabling silent exfiltration of sensitive files such as SSH private keys or cloud credentials via subsequent tool calls.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/geo-chen/oss/blob/main/void.md
https://www.vulncheck.com/advisories/void-path-traversal-via-ai-agent-file-reading-tools

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Void hasta 1.3.4 contiene una vulnerabilidad de salto de ruta en las herramientas de lectura de archivos del agente de IA que permite a los atacantes adyacentes a la red leer archivos de host arbitrarios fuera del espacio de trabajo abierto inyectando instrucciones en el contenido que el agente procesa. Los atacantes pueden proporcionar rutas absolutas o URIs file: // a través de las herramientas read_file, ls_dir, get_dir_tree y search_*, que carecen de confinamiento del espacio de trabajo y eluden la puerta de aprobación, lo que permite la exfiltración silenciosa de archivos sensibles como claves privadas SSH o credenciales de la nube a través de llamadas de herramientas posteriores.

Information

Published : 2026-07-23 17:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-65698

Mitre link : CVE-2026-65698

CVE.ORG link : CVE-2026-65698

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-65698", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "disclosure@vulncheck.com"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65698", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T21:59:53.672619Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/voideditor/void", "vendor": "voideditor", "product": "void", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.4"}], "packageURL": "pkg:github/usefathom/fathom", "defaultStatus": "affected"}]}], "published": "2026-07-23T17:16:30.050", "references": [{"url": "https://github.com/geo-chen/oss/blob/main/void.md", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/void-path-traversal-via-ai-agent-file-reading-tools", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file:// URIs through the read_file, ls_dir, get_dir_tree, and search_* tools, which lack workspace confinement and bypass the approval gate, enabling silent exfiltration of sensitive files such as SSH private keys or cloud credentials via subsequent tool calls."}, {"lang": "es", "value": "Void hasta 1.3.4 contiene una vulnerabilidad de salto de ruta en las herramientas de lectura de archivos del agente de IA que permite a los atacantes adyacentes a la red leer archivos de host arbitrarios fuera del espacio de trabajo abierto inyectando instrucciones en el contenido que el agente procesa. Los atacantes pueden proporcionar rutas absolutas o URIs file: // a trav\u00e9s de las herramientas read_file, ls_dir, get_dir_tree y search_*, que carecen de confinamiento del espacio de trabajo y eluden la puerta de aprobaci\u00f3n, lo que permite la exfiltraci\u00f3n silenciosa de archivos sensibles como claves privadas SSH o credenciales de la nube a trav\u00e9s de llamadas de herramientas posteriores."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "disclosure@vulncheck.com"}