GHSA-8cxw-cc62-q28v: ciguard: discover_pipeline_files follows symlinks out of scan root
- Identifiers
- CVE-2026-44220GHSA-8cxw-cc62-q28v
- Published
- Record updated
- Affected
- ciguard >= 0.8.0, <= 0.8.1
- Fixed in
- 0.8.2
- released April 26, 2026, 9 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
The discover_pipeline_files() function in src/ciguard/discovery.py, introduced in v0.8.0 and used by the MCP scan_repo tool in v0.8.1, follows symlinks during directory walks. An attacker who can plant a symlink in a scanned directory can make discovery return pipeline-shaped files outside the requested root, and an AI agent driven by an adversarial prompt can then read their content through later scan calls. The CVSS v3.1 score is 4.4 (Medium), and the v4.0 score is 5.7 (Medium) per the first.org calculator, while GitHub's calculator returns 2.4 (Low).
Mitigation
Fixed in v0.8.2: discover_pipeline_files gains a follow_symlinks: bool = False parameter that refuses to descend into symlinked directories or files by default, and results are filtered to paths whose resolved location lies under the resolved root, even when follow_symlinks=True. A CI regression gate was added in v0.8.3.
Related items
- MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
- MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
- MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
- MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
- CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database