CVE-2026-108600

The open-multi-agent (@open-multi-agent/core) package (versions 1.5.0 through 1.21.2 ) is vulnerable to a link following vulnerability (CWE-59) within the file_write tool sandbox . This flaw allows an attacker to escape the workspace root and create files in unauthorized locations by using dangli...

CVE-2026-108600 open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink

open-multi-agent @open-multi-agent/core 1.5.0 through 1.21.2 contains a link following vulnerability in the filewrite tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the age...

CVE-2026-108600 open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink

open-multi-agent @open-multi-agent/core 1.5.0 through 1.21.2 contains a link following vulnerability in the filewrite tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the age...

CVE-2026-95660

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

CVE-2026-95660

A security flaw in Moonshot AI Kimi Code (up to version 0.31.0) allows for OS command injection via an unknown function in the MCP Configuration Loader component, specifically within the agent-core-v2/src/agent/mcp/config-loader.ts file. The vulnerability can be triggered remotely through the man...

CVE-2026-95660: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

PT-2026-96932

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

@whalent/agent (0.3.231) potentially affected by unknown CVE via @whalent/agent-core (0.3.231)

@whalent/agent-core NPM version 0.3.231 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.231 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.233) potentially affected by unknown CVE via @whalent/agent-core (0.3.233)

@whalent/agent-core NPM version 0.3.233 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.233 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.234) potentially affected by unknown CVE via @whalent/agent-core (0.3.234)

@whalent/agent-core NPM version 0.3.234 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.234 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.239) potentially affected by unknown CVE via @whalent/agent-core (0.3.239)

@whalent/agent-core NPM version 0.3.239 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.239 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.295) potentially affected by unknown CVE via @whalent/agent-core (0.3.295)

@whalent/agent-core NPM version 0.3.295 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.295 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.297) potentially affected by unknown CVE via @whalent/agent-core (0.3.297)

@whalent/agent-core NPM version 0.3.297 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.297 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.266) potentially affected by unknown CVE via @whalent/agent-core (0.3.266)

@whalent/agent-core NPM version 0.3.266 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.266 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.288) potentially affected by unknown CVE via @whalent/agent-core (0.3.288)

@whalent/agent-core NPM version 0.3.288 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.288 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.245) potentially affected by unknown CVE via @whalent/agent-core (0.3.245)

@whalent/agent-core NPM version 0.3.245 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.245 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.244) potentially affected by unknown CVE via @whalent/agent-core (0.3.244)

@whalent/agent-core NPM version 0.3.244 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.244 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.251) potentially affected by unknown CVE via @whalent/agent-core (0.3.251)

@whalent/agent-core NPM version 0.3.251 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.251 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.265) potentially affected by unknown CVE via @whalent/agent-core (0.3.265)

@whalent/agent-core NPM version 0.3.265 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.265 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.278) potentially affected by unknown CVE via @whalent/agent-core (0.3.278)

@whalent/agent-core NPM version 0.3.278 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.278 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...