CVE-2026-108600 open-multi-agent CVE debrief

Who should care

Defenders responsible for open-multi-agent/core deployments should assess exposure and prioritize verification of versions in use. This involves reviewing the workspace for dangling symlinks and ensuring that the agent process does not have write access to sensitive areas.

Why it matters

CVE-2026-108600 is a link following vulnerability in open-multi-agent (@open-multi-agent/core) versions 1.5.0 through 1.21.2 that allows attackers to create files outside the workspace root. Defenders should prioritize verifying versions, reviewing the workspace for dangling symlinks, and ensuring the agent process does not have write access to sensitive areas.

• Verify versions of open-multi-agent/core in use to assess exposure
• Review workspace for dangling symlinks to prevent potential attacks
• Ensure agent process does not have write access to sensitive areas
• Prioritize remediation based on the CVSS score of 5.7 (MEDIUM)

Technical summary

The vulnerability is caused by a link following issue in the file_write tool sandbox of open-multi-agent (@open-multi-agent/core) versions 1.5.0 through 1.21.2. This allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write.

Defensive priority

Defenders should prioritize verifying the versions of open-multi-agent/core in use and assessing exposure to potential attacks. This involves reviewing the workspace for dangling symlinks and ensuring that the agent process does not have write access to sensitive areas.

Recommended defensive actions

• Verify the versions of open-multi-agent/core in use
• Assess exposure to potential attacks
• Review the workspace for dangling symlinks
• Ensure the agent process does not have write access to sensitive areas
• Perform asset inventory to identify potentially exposed systems
• Implement compensating controls for exposed systems
• Monitor for suspicious activity related to the vulnerability

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information, which requires verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.