CVE-2026-108592: medium-severity vulnerability in SWE-agent mini-swe-agent
mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment
Published · Updated
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6epss 0.3%
from disclosure to weapon0 days
Published on NVDOct 10
1st PoCOct 10
exploitation probability
0.3%top 77% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
SWE-agent · mini-swe-agentpublic PoCs found — 1
githubgithub.com/asvorg/CVE-2026-108592-poc★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://github.com/SWE-agent/mini-swe-agenthttps://github.com/SWE-agent/mini-swe-agent/blob/v2.4.6/src/minisweagent/environments/extra/bubblewrap.py#L38-L103https://hackmd.io/@haind/minisweagent-bubblewrap-host-environment-leakhttps://www.vulncheck.com/advisories/mini-swe-agent-1.10.0-through-2.4.6-environment-exposure-via-bubblewrapenvironment