{"data":{"id":"c1ca171d-7ace-46ef-8814-20f82f6594e0","title":"GHSA-8cxw-cc62-q28v: ciguard: discover_pipeline_files follows symlinks out of scan root","summary":"The discover_pipeline_files() function in src/ciguard/discovery.py, introduced in v0.8.0 and used by the MCP scan_repo tool in v0.8.1, follows symlinks during directory walks. An attacker who can plant a symlink in a scanned directory can make discovery return pipeline-shaped files outside the requested root, and an AI agent driven by an adversarial prompt can then read their content through later scan calls. The CVSS v3.1 score is 4.4 (Medium), and the v4.0 score is 5.7 (Medium) per the first.org calculator, while GitHub's calculator returns 2.4 (Low).","solution":"Fixed in v0.8.2: discover_pipeline_files gains a follow_symlinks: bool = False parameter that refuses to descend into symlinked directories or files by default, and results are filtered to paths whose resolved location lies under the resolved root, even when follow_symlinks=True. A CI regression gate was added in v0.8.3.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-8cxw-cc62-q28v","publishedAt":"2026-05-05T22:19:23.000Z","cveId":"CVE-2026-44220","cweIds":null,"cvssScore":null,"cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":["ciguard@>= 0.8.0, <= 0.8.1 (fixed: 0.8.2)"],"affectedPackageNames":["ciguard"],"affectedPackageRefs":["pypi:ciguard"],"affectedVendors":[],"affectedVendorsRaw":["ciguard MCP server","Claude Desktop","Claude Code","Cursor","Claude SDK for Python"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00214,"epssCheckedAt":"2026-11-08T06:09:29.815Z","kevDateAdded":null,"advisoryAliases":["GHSA-8cxw-cc62-q28v"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-05T22:19:23.000Z","fixReleasedAt":"2026-04-26T23:12:26.136Z","daysToFix":-9,"fixCheckedAt":"2026-10-29T21:36:56.946Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"ciguard","fixedVersion":"0.8.2","matchedVersion":"0.8.2","fixReleasedAt":"2026-04-26T23:12:26.136Z","daysToFix":-9,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:36:56.797Z"}]}}